Bashe
Data as of August 16, 2026.
Credential exposure before the attack
33.3% of Bashe victims whose domain we can identify (36 of 108) had employee credentials leak in the 12 months before Bashe named them as a victim.
We don't know whether any of these credentials were how Bashe gained initial access.
What industries Bashe targets
Sector identified for 80 of 108 victims.
| Financial Services | 18 | |
| Government | 13 | |
| Education | 8 | |
| Technology | 8 | |
| Construction | 7 | |
| Manufacturing | 7 | |
| Retail | 4 | |
| Energy | 3 |
Where the victims are located
Country identified for 69 of 108 victims.
| United Kingdom | 5 | |
| Indonesia | 5 | |
| France | 5 | |
| Brazil | 5 | |
| Thailand | 4 | |
| India | 3 | |
| United Arab Emirates | 3 | |
| United States | 3 |
Most recent Bashe victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Metrabyte Cloud metrabyte.cloud | Not identified | Thailand | Jul 27, 2026 |
| Azarestan Business Development Group azarestan.com | Construction | Not identified | Jul 7, 2026 |
| D.G. Khan Cement dgcement.com | Construction | Not identified | Jul 7, 2026 |
| Vicente Trapani vicentetrapani.com | Manufacturing | Argentina | Jul 7, 2026 |
| Western International Group westernint.com | Manufacturing | United Arab Emirates | Jul 7, 2026 |
| Ahmet Aydeniz Group aydeniz.com | Construction | Turkey | Jul 6, 2026 |
| Flazio flazio.com | Technology | Italy | Jul 3, 2026 |
| Holiday Palace holidaypalace.com | Hospitality | Thailand | Jul 3, 2026 |
| Rita Võ Group ritavo.com | Retail | Vietnam | Jul 3, 2026 |
| Government of Brazil gov.br | Government | Brazil | Jun 24, 2026 |
| PT Portal Biz Nusantara kliknklik.com | Retail | Indonesia | Jun 24, 2026 |
| Flughafen Wien viennaairport.com | Not identified | Austria | Jun 24, 2026 |
| Arpinet arpinet.am | Telecommunications | Not identified | Jun 4, 2026 |
| Ministry of Internal Affairs of the Republic of Armenia gov.am | Government | Not identified | Jun 3, 2026 |
| Minsa minsa.com.mx | Manufacturing | Mexico | May 25, 2026 |
| TKGM tkgm.gov.tr | Government | Turkey | May 25, 2026 |
| TVN Media tvnmedia.com | Media | Germany | May 25, 2026 |
| Alkaloid AD Skopje alkaloid.com.mk | Healthcare | Not identified | May 22, 2026 |
| Grupo Petersen grupopetersen.com.ar | Financial Services | Argentina | May 22, 2026 |
| NARIT narit.or.th | Education | Thailand | May 22, 2026 |
Showing the 20 most recent of 108. Browse recent data breaches for more.
Bashe leak sites
Addresses we've seen Bashe publish victims from. Any .onion address needs the Tor Browser.
basheqtvzqwz4vp6ks5lm2ocq7i6tozqgf6vjcasj4ezmsy4bkpshhyd.onionbashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onionbashefe5uezp2jtxpk24b2pyfnnfyguicgrgqufgu57mfluegotbeayd.onionbashei5oy4zvmf2letnupwhgprdkjyssm3zxj2oyr6wfezkf3elehzqd.onionbashed52orwi7qoyvmcfkdnuaogta4inpojfd6cthzkp4qpsq64ux4ad.onionbashedl53memptddxzb4kr5mnkzse4fmhpqeq7jb4srndswar46nofid.onionbashex7mokreyoxl6wlswxl4foi7okgs7or7aergnuiockuoq35yt3ad.onionbasherq53eniermxovo3bkduw5qqq5bkqcml3qictfmamgvmzovykyqd.onionbasherykagbxoaiaxkgqhmhd5gbmedwb3di4ig3ouovziagosv4n77qd.onionbashete63b3gcijfofpw6fmn3rwnmyi5aclp55n6awcfbexivexbhyad.onion
Bashe questions
Is Bashe still active?
Yes. Bashe posted its most recent victim on July 27, 2026.
How many victims has Bashe claimed?
Bashe has named 108 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 58 of them were posted in the last 12 months.
When did Bashe first appear?
The first victim we recorded for Bashe was posted on November 25, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Bashe target?
Financial Services accounts for the most victims we can classify, with 18. Government follows at 13. We could identify a sector for 80 of 108 victims, so treat this as the shape of the targeting rather than a full census.
Has Bashe already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.