AvosLocker
Data as of September 15, 2026.
Credential exposure before the attack
42.4% of AvosLocker victims whose domain we can identify (56 of 132) had employee credentials leak in the 12 months before AvosLocker named them as a victim.
We don't know whether any of these credentials were how AvosLocker gained initial access.
What industries AvosLocker targets
Sector identified for 25 of 132 victims.
| Education | 11 | |
| Manufacturing | 4 | |
| Healthcare | 3 | |
| Government | 1 | |
| Financial Services | 1 | |
| Real Estate | 1 | |
| Retail | 1 | |
| Logistics | 1 |
Where the victims are located
Country identified for 19 of 132 victims.
| Canada | 6 | |
| United Kingdom | 3 | |
| Spain | 2 | |
| United States | 2 | |
| Australia | 1 | |
| Singapore | 1 | |
| Belgium | 1 | |
| Malaysia | 1 |
Most recent AvosLocker victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| bluefield.edu | Education | Not identified | May 4, 2023 |
| dijones.com.au | Real Estate | Australia | May 1, 2023 |
| roseman.edu | Education | Not identified | May 1, 2023 |
| cavalierhospital.com | Healthcare | Not identified | Apr 25, 2023 |
| laragh.com | Not identified | Not identified | Apr 20, 2023 |
| sunpowermarine.com | Not identified | Not identified | Apr 13, 2023 |
| vmedia.ca | Not identified | Canada | Apr 13, 2023 |
| accolade-group.com | Not identified | Not identified | Mar 28, 2023 |
| maneygordon.com | Not identified | Not identified | Mar 28, 2023 |
| tiptoppoultry.com | Not identified | Not identified | Mar 28, 2023 |
| acesconn.com | Not identified | Not identified | Mar 17, 2023 |
| desman.com | Government | Not identified | Mar 17, 2023 |
| entigrity.com | Financial Services | Not identified | Mar 17, 2023 |
| methodistfamily.org | Not identified | Not identified | Mar 9, 2023 |
| openmribala.com | Not identified | Not identified | Mar 3, 2023 |
| titlecashnow.com | Not identified | Not identified | Mar 3, 2023 |
| cambiangroup.com | Education | Not identified | Jan 10, 2023 |
| azlaborforce.com | Not identified | Not identified | Jan 9, 2023 |
| corporate-interiors.com | Not identified | Not identified | Jan 9, 2023 |
| cosmopointcolledge.com | Not identified | Not identified | Oct 21, 2022 |
Showing the 20 most recent of 132. Browse recent data breaches for more.
AvosLocker leak sites
Addresses we've seen AvosLocker publish victims from. Any .onion address needs the Tor Browser.
avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onionanonfiles.comrkipz2psf2lmwumohlngdsx4ilhl7xwjut5rcdwnfscsjswrsk2blpad.onionsend.exploit.inmega.nzshare.riseup.netwe.tlwww.sendspace.comufile.iodropmefiles.com.uawdfiles.ruavosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion.wsrkipz2psf2lmwumohlngdsx4ilhl7xwjut5rcdwnfscsjswrsk2blpad.onion.wsqaz.imavosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion.lytemp.sh5ety7tpkim5me6eszuwcje7bmy25pbtrjtue7zkqqgziljwqy3rrikqd.onion
AvosLocker questions
Is AvosLocker still active?
Not for over a year. The last victim we recorded was May 4, 2023. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has AvosLocker claimed?
AvosLocker has named 132 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did AvosLocker first appear?
The first victim we recorded for AvosLocker was posted on July 8, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does AvosLocker target?
Education accounts for the most victims we can classify, with 11. Manufacturing follows at 4. We could identify a sector for 25 of 132 victims, so treat this as the shape of the targeting rather than a full census.
Has AvosLocker already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.