Bluebox
Data as of August 16, 2026.
What industries Bluebox targets
Sector identified for 2 of 4 victims.
| Manufacturing | 1 | |
| Logistics | 1 |
Where the victims are located
Country identified for 2 of 4 victims.
| France | 1 | |
| Sweden | 1 |
Every Bluebox victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Groupe-fimar groupe-fimar.com | Not identified | Not identified | Dec 18, 2024 |
| Westerstrand westerstrand.com | Not identified | Not identified | Dec 18, 2024 |
| PH Architecture pharchitecture.fr | Manufacturing | France | Dec 11, 2024 |
| Westerstrand Urfabrik AB westerstrand.se | Logistics | Sweden | Dec 11, 2024 |
Browse recent data breaches for more.
Bluebox leak sites
Addresses we've seen Bluebox publish victims from. Any .onion address needs the Tor Browser.
zu3wfrmrkl4ltqqnpt3owp3cwa33rqwod4gpe3ttb5o4vf2is2gzm6qd.onionmega.nz
Bluebox questions
Is Bluebox still active?
Not for over a year. The last victim we recorded was December 19, 2024. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Bluebox claimed?
Bluebox has named 4 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Bluebox first appear?
The first victim we recorded for Bluebox was posted on December 11, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Has Bluebox already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.