BlackShrantac
Data as of August 16, 2026.
Credential exposure before the attack
6.7% of BlackShrantac victims whose domain we can identify (3 of 45) had employee credentials leak in the 12 months before BlackShrantac named them as a victim.
We don't know whether any of these credentials were how BlackShrantac gained initial access.
What industries BlackShrantac targets
Sector identified for 33 of 45 victims.
| Manufacturing | 9 | |
| Construction | 5 | |
| Technology | 4 | |
| Financial Services | 3 | |
| Healthcare | 3 | |
| Hospitality | 2 | |
| Education | 2 | |
| Government | 2 |
Where the victims are located
Country identified for 43 of 45 victims.
| United States | 9 | |
| Turkey | 5 | |
| India | 5 | |
| Peru | 4 | |
| Indonesia | 2 | |
| Australia | 2 | |
| Malaysia | 2 | |
| Singapore | 2 |
Most recent BlackShrantac victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Banister House School banisterschool.co.uk | Education | United Kingdom | Apr 20, 2026 |
| Mowilex mowilex.com | Manufacturing | Indonesia | Apr 20, 2026 |
| Adfactors adfactorspr.com | Not identified | India | Mar 30, 2026 |
| Nattivo Collection Hotel nattivocollectionhotel.com | Hospitality | Colombia | Mar 16, 2026 |
| Alphington Sports Medicine Clinic alphingtonsportsmed.com.au | Healthcare | Australia | Mar 6, 2026 |
| Ambicare Health ambicare.com | Healthcare | United States | Mar 6, 2026 |
| F-One f-one.co.jp | Manufacturing | Japan | Mar 6, 2026 |
| Flooring Installation Systems flooringinstallationsystems.com | Construction | United States | Mar 6, 2026 |
| Market Connections Asia marketconnectionsasia.com | Not identified | Singapore | Mar 6, 2026 |
| UGO Group ugogroup.com | Manufacturing | Poland | Mar 6, 2026 |
| LM Metro Hotel lmmetrohotelph.com | Hospitality | Philippines | Jan 29, 2026 |
| Market Connections Asia Public marketconnectionsasia.com | Not identified | Singapore | Jan 29, 2026 |
| PKT Quantity Surveying Consultant pktqs.com | Construction | Malaysia | Jan 22, 2026 |
| Agrícola Cerro Prieto acpagro.com | Agriculture | Peru | Dec 26, 2025 |
| Netstar Australia netstaraustralia.com.au | Technology | Australia | Dec 18, 2025 |
| Dem İlaç demilac.com.tr | Healthcare | Turkey | Dec 16, 2025 |
| VFM Systems & Services vfmindia.biz | Technology | India | Dec 15, 2025 |
| Badan Pengelola Keuangan Haji bpkh.go.id | Financial Services | Indonesia | Dec 1, 2025 |
| Rasen Insaat Ve Yatirim Ticaret rasen.com.tr | Construction | Turkey | Dec 1, 2025 |
| M&BM mbm-bg.com | Not identified | Bulgaria | Nov 14, 2025 |
Showing the 20 most recent of 45. Browse recent data breaches for more.
BlackShrantac leak sites
Addresses we've seen BlackShrantac publish victims from. Any .onion address needs the Tor Browser.
b2ykcy2gcug4gnccm6hnrb5xapnresmyjjqgvhafaypppwgo4feixwyd.onionshrantacpxim7z6m6pnszi52bb2tp23sntby3hklt36rezdja7bdjsyd.onionjvkpexgkuaw5toiph7fbgucycvnafaqmfvakymfh5pdxepvahw3xryqd.onionz3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
BlackShrantac questions
Is BlackShrantac still active?
It's gone quiet. The last victim we recorded was April 20, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has BlackShrantac claimed?
BlackShrantac has named 45 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 42 of them were posted in the last 12 months.
When did BlackShrantac first appear?
The first victim we recorded for BlackShrantac was posted on September 18, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does BlackShrantac target?
Manufacturing accounts for the most victims we can classify, with 9. Construction follows at 5. We could identify a sector for 33 of 45 victims, so treat this as the shape of the targeting rather than a full census.
Has BlackShrantac already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.