BianLian

Dark since April 1, 2025
Also tracked as BiaLian
491 victims named on the leak site
0 in the last 30 days
0 in the last 12 months
Feb 2022 first victim we recorded
Apr 1, 2025 most recent victim posted
19 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

25.1% of BianLian victims whose domain we can identify (123 of 491) had employee credentials leak in the 12 months before BianLian named them as a victim.

We don't know whether any of these credentials were how BianLian gained initial access.

What industries BianLian targets

Sector identified for 310 of 491 victims.

Healthcare57
Manufacturing51
Financial Services48
Legal39
Construction23
Education19
Technology18
Logistics18

Where the victims are located

Country identified for 94 of 491 victims.

United States16
United Kingdom15
Australia11
Canada11
India9
Japan3
Spain3
Italy3

Most recent BianLian victims

VictimSectorCountryPosted
CMC Technology Group cmctechgroup.comNot identifiedNot identifiedApr 1, 2025
Meridian Senior Living meridiansenior.comNot identifiedNot identifiedApr 1, 2025
Saunders and Saunders saundersandsaunders.comLegalNot identifiedApr 1, 2025
Sonrisas Dental Health sonrisasdental.orgHealthcareNot identifiedApr 1, 2025
Goshen Medical Center goshenmedical.orgHealthcareNot identifiedMar 24, 2025
Receivership Specialists receivershipspecialists.comNot identifiedNot identifiedMar 20, 2025
Allworx allworx.comNot identifiedNot identifiedMar 10, 2025
Island Realty islandrealty.comReal EstateNot identifiedMar 10, 2025
Minnesota Orthodontics minnesotaorthodontics.comNot identifiedNot identifiedMar 10, 2025
Ewald Consulting ewald.comFinancial ServicesNot identifiedMar 5, 2025
Legal Aid Society of Salt Lake legalaidsocietyofsaltlake.orgLegalNot identifiedMar 5, 2025
Mosley Glick O’Brien, Inc. mgoinc.comFinancial ServicesNot identifiedMar 5, 2025
Alabama Ophthalmology Associates aoapc.comNot identifiedNot identifiedFeb 20, 2025
Aspire Rural Health System aspirerhs.orgEducationNot identifiedFeb 14, 2025
Dain, Torpy daintorpy.comLegalNot identifiedFeb 14, 2025
Financial Services of America fsa1.comFinancial ServicesNot identifiedFeb 14, 2025
Layfield & Borel CPAs layfieldandborelcpas.comFinancial ServicesNot identifiedFeb 14, 2025
Mobilize.Net mobilize.netNot identifiedNot identifiedFeb 14, 2025
Nash Brothers Construction nashbrothers.comConstructionNot identifiedFeb 14, 2025
Nippon Steel nipponsteel.comManufacturingJapanFeb 14, 2025

Showing the 20 most recent of 491. Browse recent data breaches for more.

BianLian leak sites

Addresses we've seen BianLian publish victims from. Any .onion address needs the Tor Browser.

  • bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion
  • bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion
  • qahjimrublt35jlv4teesicrw6zhpwhkb6nhtonwxuqafmjhr7hax2id.onion
  • anonfiles.com
  • ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion
  • xeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onion
  • lockbitst7jglgbsj7aijbiqvxwmlhcs7e7gb3eeqx7rjtxsjklw4yyd.onion
  • lockbitwnklgh3lt6umrbiztgzl6qujtovdtcovdjhavepp7bpvcmfid.onion
  • lockbity7oz7kjcdcgacvihhsli6oimuodmmaftw5omdpgscxdc3mhid.onion
  • canarodqqttgf2ofv7rkj74jvani7f2ftrbkmuw7zwyydlxikazimyqd.onion
  • lockbit2zfxali5yrplh5swimxva5o4xqi3zpbc24tczgffxh7msrvyd.onion
  • lockbit3m6lgexvokfxyqcdnykdvhye7aftic6p4uh7mnz42h25ooiid.onion
  • lockbit7gtvdkx7j3tyfpw43zv6majh2owrsp3zilhpm36a3fldqtyqd.onion
  • lockbitbuy3gsqwrgavmi3ehlmk26h6g3aeyslnq4yksjcbpt6ij5cqd.onion
  • lockbitjvv72zmzgcqgn63ehjaapffubbwjwi32gzdbrahxjy3hzrxid.onion
  • lockbitnthkolp2mfa5byjrx2mcbleruktoiawsprqrducnrzilchjid.onion
  • lockbit33chewwx25efq6dgkhkw4u7nefudq4ijkuamjfd7x73on6dyd.onion
  • 3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion
  • bianliaoxoeriowgqohcly4a6sbkpc3se2yvxgidxomxlpuhx5ehrpad.onion

BianLian questions

Is BianLian still active?

Not for over a year. The last victim we recorded was April 1, 2025. The leak site has published nothing since, though the data it already leaked is still out there.

How many victims has BianLian claimed?

BianLian has named 491 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did BianLian first appear?

The first victim we recorded for BianLian was posted on February 7, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does BianLian target?

Healthcare accounts for the most victims we can classify, with 57. Manufacturing follows at 51. We could identify a sector for 310 of 491 victims, so treat this as the shape of the targeting rather than a full census.

Has BianLian already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.