BEAST
Data as of September 14, 2026.
Credential exposure before the attack
16.9% of BEAST victims whose domain we can identify (12 of 71) had employee credentials leak in the 12 months before BEAST named them as a victim.
We don't know whether any of these credentials were how BEAST gained initial access.
What industries BEAST targets
Sector identified for 57 of 71 victims.
| Manufacturing | 13 | |
| Healthcare | 12 | |
| Education | 7 | |
| Financial Services | 4 | |
| Legal | 4 | |
| Construction | 3 | |
| Non-profit | 3 | |
| Retail | 2 |
Where the victims are located
Country identified for 54 of 71 victims.
| United States | 22 | |
| United Kingdom | 8 | |
| Brazil | 4 | |
| Canada | 3 | |
| South Korea | 3 | |
| China | 3 | |
| Australia | 2 | |
| Germany | 2 |
Most recent BEAST victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| M800 m800.com | Telecommunications | Not identified | Sep 11, 2026 |
| Cosmon cosmon.com | Not identified | United States | Aug 26, 2026 |
| Meridian Forest Services meridianforest.ca | Not identified | Canada | Aug 25, 2026 |
| Trivantage trivantage.com | Manufacturing | United States | May 18, 2026 |
| Lessard Dental lessarddental.com | Healthcare | Canada | Apr 27, 2026 |
| Irmler irmler.org | Manufacturing | Germany | Apr 10, 2026 |
| Project 1631 project1631.com | Non-profit | United States | Apr 6, 2026 |
| CXTC cxtc.com | Manufacturing | China | Apr 1, 2026 |
| Communicate UK communicateuk.co.uk | Not identified | United Kingdom | Mar 16, 2026 |
| Trinity Catholic High School trinitycatholichs.org | Education | United States | Mar 16, 2026 |
| Camelot PCB camelotpcb.com | Manufacturing | China | Mar 4, 2026 |
| Aju Pharm ajupharm.co.kr | Healthcare | South Korea | Feb 25, 2026 |
| SAIC Motor saicmotor.com | Manufacturing | China | Feb 25, 2026 |
| Sungwoo sungwooco.kr | Manufacturing | South Korea | Feb 25, 2026 |
| Dr. Kaler Medical Practice drkaler.com | Healthcare | United States | Feb 19, 2026 |
| First4 Recruitment first4-recruitment.com | Not identified | United Kingdom | Feb 19, 2026 |
| Andringa Law andringalaw.com | Legal | United States | Feb 12, 2026 |
| Cox Sanchez coxsanchez.com | Legal | United States | Feb 12, 2026 |
| Hospital São José do Avaí hsja.com.br | Healthcare | Brazil | Feb 10, 2026 |
| Yulkok yulkok.com | Retail | South Korea | Feb 6, 2026 |
Showing the 20 most recent of 71. Browse recent data breaches for more.
BEAST leak site
The address we've seen BEAST publish victims from. Any .onion address needs the Tor Browser.
beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion
BEAST questions
Is BEAST still active?
Yes. BEAST posted its most recent victim on September 11, 2026. That's 3 victims in the last 30 days.
How many victims has BEAST claimed?
BEAST has named 71 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 41 of them were posted in the last 12 months.
When did BEAST first appear?
The first victim we recorded for BEAST was posted on July 30, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does BEAST target?
Manufacturing accounts for the most victims we can classify, with 13. Healthcare follows at 12. We could identify a sector for 57 of 71 victims, so treat this as the shape of the targeting rather than a full census.
Has BEAST already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.