0APT
Data as of August 16, 2026.
Credential exposure before the attack
59.7% of 0APT victims whose domain we can identify (120 of 201) had employee credentials leak in the 12 months before 0APT named them as a victim.
We don't know whether any of these credentials were how 0APT gained initial access.
What industries 0APT targets
Sector identified for 178 of 201 victims.
| Manufacturing | 72 | |
| Healthcare | 50 | |
| Construction | 12 | |
| Technology | 11 | |
| Government | 6 | |
| Financial Services | 5 | |
| Energy | 4 | |
| Logistics | 4 |
Where the victims are located
Country identified for 183 of 201 victims.
| United States | 97 | |
| United Kingdom | 16 | |
| France | 10 | |
| Japan | 10 | |
| Switzerland | 8 | |
| Germany | 5 | |
| Canada | 5 | |
| Sweden | 5 |
Most recent 0APT victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Alamo Group alamo-group.com | Manufacturing | United States | Feb 12, 2026 |
| Astec Industries astecindustries.com | Construction | United States | Feb 12, 2026 |
| Badger Meter badgermeter.com | Government | United States | Feb 12, 2026 |
| Barnes Group barnesgroupinc.com | Manufacturing | United States | Feb 12, 2026 |
| Belden belden.com | Manufacturing | United States | Feb 12, 2026 |
| Chart Industries chartindustries.com | Manufacturing | United States | Feb 12, 2026 |
| Columbus McKinnon columbusmckinnon.com | Manufacturing | United States | Feb 12, 2026 |
| Curtiss Wright curtisswright.com | Manufacturing | United States | Feb 12, 2026 |
| Donaldson donaldson.com | Manufacturing | United States | Feb 12, 2026 |
| Enerpac Tool Group enerpactoolgroup.com | Manufacturing | United States | Feb 12, 2026 |
| EnPro Industries enpro.com | Manufacturing | United States | Feb 12, 2026 |
| Entegris entegris.com | Healthcare | United States | Feb 12, 2026 |
| ESAB esab.com | Manufacturing | United States | Feb 12, 2026 |
| Federal Signal federalsignal.com | Government | United States | Feb 12, 2026 |
| Franklin Electric franklin-electric.com | Manufacturing | United States | Feb 12, 2026 |
| Gencor Industries gencor.com | Manufacturing | United States | Feb 12, 2026 |
| Graco graco.com | Manufacturing | United States | Feb 12, 2026 |
| Gorman Rupp Pumps grpumps.com | Government | United States | Feb 12, 2026 |
| Helios Technologies heliostechnologies.com | Manufacturing | United States | Feb 12, 2026 |
| Hillenbrand hillenbrand.com | Healthcare | United States | Feb 12, 2026 |
Showing the 20 most recent of 201. Browse recent data breaches for more.
0APT leak site
The address we've seen 0APT publish victims from. Any .onion address needs the Tor Browser.
oaptxiyisljt2kv3we2we34kuudmqda7f2geffoylzpeo7ourhtz4dad.onion
0APT questions
Is 0APT still active?
It's gone quiet. The last victim we recorded was February 12, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has 0APT claimed?
0APT has named 201 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did 0APT first appear?
The first victim we recorded for 0APT was posted on January 26, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does 0APT target?
Manufacturing accounts for the most victims we can classify, with 72. Healthcare follows at 50. We could identify a sector for 178 of 201 victims, so treat this as the shape of the targeting rather than a full census.
Has 0APT already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.