BlackBasta
Data as of August 16, 2026.
Credential exposure before the attack
23.6% of BlackBasta victims whose domain we can identify (127 of 537) had employee credentials leak in the 12 months before BlackBasta named them as a victim.
We don't know whether any of these credentials were how BlackBasta gained initial access.
What industries BlackBasta targets
Sector identified for 277 of 537 victims.
| Manufacturing | 83 | |
| Construction | 34 | |
| Financial Services | 24 | |
| Legal | 23 | |
| Healthcare | 20 | |
| Logistics | 20 | |
| Real Estate | 14 | |
| Energy | 12 |
Where the victims are located
Country identified for 137 of 537 victims.
| Germany | 40 | |
| United Kingdom | 21 | |
| Canada | 15 | |
| Australia | 12 | |
| Italy | 8 | |
| United States | 8 | |
| Netherlands | 7 | |
| Switzerland | 6 |
Most recent BlackBasta victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Arun Estates arunestates.co.uk | Not identified | United Kingdom | Jan 13, 2025 |
| Avril avril.ca | Not identified | Canada | Jan 13, 2025 |
| Bnext.nl bnext.nl | Not identified | Netherlands | Jan 13, 2025 |
| Brachot brachot.com | Manufacturing | Not identified | Jan 13, 2025 |
| Granby Industries granbyindustries.com | Manufacturing | Not identified | Jan 13, 2025 |
| Mortgage Investors Group migonline.com | Not identified | Not identified | Jan 13, 2025 |
| Plasma-Therm plasmatherm.com | Manufacturing | Not identified | Jan 13, 2025 |
| Schuff schuff.com | Manufacturing | Not identified | Jan 13, 2025 |
| Active Dynamics activedynamics.com | Not identified | Not identified | Dec 19, 2024 |
| Bath Fitter bathfitter.com | Not identified | Not identified | Dec 19, 2024 |
| Bender bender.de | Healthcare | Germany | Dec 19, 2024 |
| Fruit of the Earth fote.com | Healthcare | Not identified | Dec 19, 2024 |
| Furmano\'s furmanos.com | Not identified | Not identified | Dec 19, 2024 |
| Grimaldi Alliance grimaldialliance.com | Legal | Not identified | Dec 19, 2024 |
| Medion medion.com | Not identified | Not identified | Dec 19, 2024 |
| Valveworks USA valveworksusa.com | Energy | Not identified | Dec 19, 2024 |
| Wikov wikov.com | Manufacturing | Not identified | Dec 19, 2024 |
| BEKO Technologies beko-technologies.com | Not identified | Not identified | Dec 5, 2024 |
| BT Group btci.com | Telecommunications | United Kingdom | Dec 5, 2024 |
| Café Zupas cafezupas.com | Hospitality | Not identified | Dec 5, 2024 |
Showing the 20 most recent of 537. Browse recent data breaches for more.
BlackBasta leak sites
Addresses we've seen BlackBasta publish victims from. Any .onion address needs the Tor Browser.
stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onionfmzipzpirdpfelbbvnfhoehqxbqg7s7efmgce6hpr5xdcmeazdmic2id.onionr6qkk55wxvy2ziy47oyhptesucwdqqaip23uxregdgquq5oxxlpeecad.onionl6zxfn3u2s4bl4vt3nvpve6uibqn3he3tgwdpkeeplhwlfwy3ifbt5id.oniongreenmotor.topdownloaddotaviablogadd.iogreenmotors.topmegatron2.toponlylegalstuff7.toponlylegalstuff8.toponlylegalstuff9.tophstniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onionz6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.oniononlylegalstuff5.toponlylegalstuff6.toptoomuchdata.toponlylegalstuff15.topnoabusepls.topstopabuse.topxfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onionstopabuse1.topstopabuse2.topstopabuse3.topstuffstevenpeters6.topstopabuse4.top
BlackBasta questions
Is BlackBasta still active?
Not for over a year. The last victim we recorded was January 20, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has BlackBasta claimed?
BlackBasta has named 537 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did BlackBasta first appear?
The first victim we recorded for BlackBasta was posted on June 8, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does BlackBasta target?
Manufacturing accounts for the most victims we can classify, with 83. Construction follows at 34. We could identify a sector for 277 of 537 victims, so treat this as the shape of the targeting rather than a full census.
Has BlackBasta already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.