BEAST

Active
68 victims named on the leak site
0 in the last 30 days
50 in the last 12 months
Jul 2025 first victim we recorded
May 18, 2026 most recent victim posted
1 leak site tracked

Data as of August 16, 2026.

Credential exposure before the attack

16.2% of BEAST victims whose domain we can identify (11 of 68) had employee credentials leak in the 12 months before BEAST named them as a victim.

We don't know whether any of these credentials were how BEAST gained initial access.

What industries BEAST targets

Sector identified for 56 of 68 victims.

Manufacturing13
Healthcare12
Education7
Financial Services4
Legal4
Construction3
Non-profit3
Retail2

Where the victims are located

Country identified for 52 of 68 victims.

United States21
United Kingdom8
Brazil4
South Korea3
China3
Canada2
Germany2
Australia2

Most recent BEAST victims

VictimSectorCountryPosted
Trivantage trivantage.comManufacturingUnited StatesMay 18, 2026
Lessard Dental lessarddental.comHealthcareCanadaApr 27, 2026
Irmler irmler.orgManufacturingGermanyApr 10, 2026
Project 1631 project1631.comNon-profitUnited StatesApr 6, 2026
CXTC cxtc.comManufacturingChinaApr 1, 2026
Communicate UK communicateuk.co.ukNot identifiedUnited KingdomMar 16, 2026
Trinity Catholic High School trinitycatholichs.orgEducationUnited StatesMar 16, 2026
Camelot PCB camelotpcb.comManufacturingChinaMar 4, 2026
Aju Pharm ajupharm.co.krHealthcareSouth KoreaFeb 25, 2026
SAIC Motor saicmotor.comManufacturingChinaFeb 25, 2026
Sungwoo sungwooco.krManufacturingSouth KoreaFeb 25, 2026
Dr. Kaler Medical Practice drkaler.comHealthcareUnited StatesFeb 19, 2026
First4 Recruitment first4-recruitment.comNot identifiedUnited KingdomFeb 19, 2026
Andringa Law andringalaw.comLegalUnited StatesFeb 12, 2026
Cox Sanchez coxsanchez.comLegalUnited StatesFeb 12, 2026
Hospital São José do Avaí hsja.com.brHealthcareBrazilFeb 10, 2026
Yulkok yulkok.comRetailSouth KoreaFeb 6, 2026
Ruskin College ruskin.ac.ukEducationUnited KingdomJan 29, 2026
St Andrews School Worthing sta-worthing.comEducationUnited KingdomJan 26, 2026
Orthopaedic Specialists of Massachusetts orthomass.comHealthcareUnited StatesJan 22, 2026

Showing the 20 most recent of 68. Browse recent data breaches for more.

BEAST leak site

The address we've seen BEAST publish victims from. Any .onion address needs the Tor Browser.

  • beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion

BEAST questions

Is BEAST still active?

Yes. BEAST posted its most recent victim on May 18, 2026.

How many victims has BEAST claimed?

BEAST has named 68 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 50 of them were posted in the last 12 months.

When did BEAST first appear?

The first victim we recorded for BEAST was posted on July 30, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does BEAST target?

Manufacturing accounts for the most victims we can classify, with 13. Healthcare follows at 12. We could identify a sector for 56 of 68 victims, so treat this as the shape of the targeting rather than a full census.

Has BEAST already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.