BlackLock
Data as of August 16, 2026.
Credential exposure before the attack
43.2% of BlackLock victims whose domain we can identify (19 of 44) had employee credentials leak in the 12 months before BlackLock named them as a victim.
We don't know whether any of these credentials were how BlackLock gained initial access.
What industries BlackLock targets
Sector identified for 22 of 44 victims.
| Manufacturing | 6 | |
| Financial Services | 3 | |
| Construction | 3 | |
| Technology | 3 | |
| Automotive | 2 | |
| Education | 1 | |
| Government | 1 | |
| Real Estate | 1 |
Where the victims are located
Country identified for 10 of 44 victims.
| Australia | 2 | |
| Canada | 2 | |
| United States | 2 | |
| Spain | 1 | |
| Thailand | 1 | |
| Italy | 1 | |
| France | 1 |
Most recent BlackLock victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Oxford Universal oxforduniversal.com | Construction | Not identified | Jul 3, 2025 |
| NK Customer Solutions nkcustomer.com | Not identified | Not identified | Jun 30, 2025 |
| Ubon Ratchathani University ubu.ac.th | Education | Thailand | Jun 27, 2025 |
| Olivera Canarias oliveracanarias.com | Manufacturing | Spain | Jun 25, 2025 |
| Ryan Harvie McEnery rhmc.com.au | Financial Services | Australia | Jun 6, 2025 |
| Bridgestone Service Centre Shepparton bridgestoneshepparton.com.au | Automotive | Australia | Jun 5, 2025 |
| Neurosurgeons of New Jersey neurosurgeonsofnewjersey.com | Not identified | Not identified | May 29, 2025 |
| QuickFrames USA quickframes.com | Not identified | Not identified | May 29, 2025 |
| Rees NDT reesndt.com | Not identified | Canada | Jan 23, 2025 |
| EVAS Air evasair.com | Not identified | Not identified | Jan 10, 2025 |
| Akantha akantha.fr | Legal | France | Jan 6, 2025 |
| Datascan datascan.com | Technology | Not identified | Jan 5, 2025 |
| Hasa hasa-arg.com | Manufacturing | Not identified | Jan 5, 2025 |
| Perú Controls perucontrols.com | Not identified | Not identified | Jan 5, 2025 |
| D&G Enviro-Group dgenviro.com | Not identified | Not identified | Dec 29, 2024 |
| Relate Infotech relate-infotech.com | Technology | Not identified | Dec 26, 2024 |
| Acumen Group acumengroup.us | Not identified | United States | Dec 17, 2024 |
| Lasen lasen.com | Not identified | Not identified | Dec 17, 2024 |
| First Baptist Church of High Springs fbchighsprings.org | Not identified | Not identified | Dec 16, 2024 |
| Kandelaar kandelaar.com | Energy | Not identified | Dec 16, 2024 |
Showing the 20 most recent of 44. Browse recent data breaches for more.
BlackLock leak sites
Addresses we've seen BlackLock publish victims from. Any .onion address needs the Tor Browser.
dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onionzdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onionsendgb.com
BlackLock questions
Is BlackLock still active?
Not for over a year. The last victim we recorded was July 3, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has BlackLock claimed?
BlackLock has named 44 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did BlackLock first appear?
The first victim we recorded for BlackLock was posted on September 30, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does BlackLock target?
Manufacturing accounts for the most victims we can classify, with 6. Financial Services follows at 3. We could identify a sector for 22 of 44 victims, so treat this as the shape of the targeting rather than a full census.
Has BlackLock already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.