Brain Cipher

Active
Also tracked as BrainCipher
90 victims named on the leak site
19 in the last 30 days
48 in the last 12 months
Jul 2024 first victim we recorded
Sep 30, 2026 most recent victim posted
22 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

27.8% of Brain Cipher victims whose domain we can identify (25 of 90) had employee credentials leak in the 12 months before Brain Cipher named them as a victim.

We don't know whether any of these credentials were how Brain Cipher gained initial access.

What industries Brain Cipher targets

Sector identified for 60 of 90 victims.

Manufacturing12
Financial Services10
Construction7
Healthcare5
Technology5
Automotive3
Logistics3
Legal3

Where the victims are located

Country identified for 64 of 90 victims.

United States25
Canada10
Spain5
France5
United Kingdom4
Australia2
Israel2
Mexico2

Most recent Brain Cipher victims

VictimSectorCountryPosted
GO Riteway goriteway.comLogisticsUnited StatesSep 30, 2026
Latitude Subrogation Services latitudesubro.comFinancial ServicesUnited StatesSep 30, 2026
Maxwell Group maxwell-group.comNot identifiedUnited StatesSep 30, 2026
McCord & Associates mccordclaims.comFinancial ServicesUnited StatesSep 30, 2026
Mulholland Energy Services mulholland.comManufacturingUnited StatesSep 30, 2026
Northeast Rehabilitation Hospital Network northeastrehab.comNot identifiedNot identifiedSep 30, 2026
Trailer Bridge trailerbridge.comLogisticsUnited StatesSep 30, 2026
Wildman Business Group wildmanbg.comNot identifiedUnited StatesSep 30, 2026
Gold Star Mortgage Financial Group goldstarfinancial.comRetailUnited StatesSep 24, 2026
AECOM aecom.comNot identifiedUnited StatesSep 18, 2026
Hoyle, Tanner & Associates hoyletanner.comConstructionUnited StatesSep 18, 2026
Xpera Risk Mitigation & Investigation xpera.caNot identifiedCanadaSep 18, 2026
AEI Consultants aeiconsultants.comNot identifiedUnited StatesSep 1, 2026
Ahad&Co ahadandco.comFinancial ServicesUnited StatesSep 1, 2026
Comprehensive Care Services ccsperfusion.comHealthcareUnited StatesSep 1, 2026
CR Meyer crmeyer.comConstructionUnited StatesSep 1, 2026
ICOT icot.esTechnologySpainSep 1, 2026
Sago sago.comNot identifiedUnited StatesSep 1, 2026
Seeliger y Conde syc.esNot identifiedSpainSep 1, 2026
Industrial Accessories iac-intl.comManufacturingUnited StatesJul 10, 2026

Showing the 20 most recent of 90. Browse recent data breaches for more.

Brain Cipher leak sites

Addresses we've seen Brain Cipher publish victims from. Any .onion address needs the Tor Browser.

  • vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
  • i6b4r6blgmm3r62zj42qxn6bvcbcrslcg6b6uwqws6xhnxz2howbhkid.onion
  • oe7kcuvnulmdzir6zkewv5p353kc7qjf5tyqxfxabhzsm26pji44elqd.onion
  • yt7beb7fj6xbh4dndrlyvl3gn4ck36qn2oqheiqjs4bp3wspj3wgpcad.onion
  • hdgfvxxkepllbvqvk7vrudgwq55tg4joo4xpajaa3nv5gzpake66bnid.onion
  • ubetdhmgnry4jk7ya7gh7p4hm4c3c57srkw62oc6hjmvvvkrqeybjjid.onion
  • q226mkoikzgyu33jin7ox3qo6tea7yhlgz52p5lslpj73edtocsz4wqd.onion
  • zv27q4tjvqxelm2imgztfg7gtl3v56oqabe77hiufqoqilis2dgcdsad.onion
  • jgkgqztfmwk53wlttsjo6i3nmwtzoch2oi2bocqzb4zmp6kfspuiaead.onion
  • lhdv4ydjx5idzvntdrmcbwsh3dhdi3ww5hoz3ws2d5q5jlfewdacx4qd.onion
  • 4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion
  • ixvarmokkir6t6fzpn7prussp3ulys66aeivrhcvrmfowqi2gi2fgryd.onion
  • mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
  • tahr6kwobsi7fj5j3hoyzxr34ipyiyuv2svhteht5td4etq23bcx7tyd.onion
  • ncyg34lipi3w2u7yvxl3swr6wj6lsoeix3grrdsn6nmcv4r7vntanoid.onion
  • 7xen2nsp66c3wutvznjffbde52n4tabrnjw7zp3yyc2vs7ovh2ndhrad.onion
  • bgpeqy3d5svuikeaueitix6zosg3pzekw77viulnucsiqsn4sjr65iyd.onion
  • as7fbsjvifse52ek5qnptfgvkduvvnl56adb3jjgk6k3p7bisipvotyd.onion
  • qwjtw3lycrt2h4ftqmuv7srmlz32ln4nxj7n532gxrtemwndcvq36cyd.onion
  • xangddavm54rgsju7iceahxztbqrcflzunffwbaswwhhftieygc4j3ad.onion
  • zke5xim35cfolmq2h5i5sfmcoxr4pbpkfjwtq5lf6o4zo7avfcvnb5qd.onion
  • cuuhrxbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onion

Brain Cipher questions

Is Brain Cipher still active?

Yes. Brain Cipher posted its most recent victim on September 30, 2026. That's 19 victims in the last 30 days.

How many victims has Brain Cipher claimed?

Brain Cipher has named 90 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 48 of them were posted in the last 12 months.

When did Brain Cipher first appear?

The first victim we recorded for Brain Cipher was posted on July 4, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Brain Cipher target?

Manufacturing accounts for the most victims we can classify, with 12. Financial Services follows at 10. We could identify a sector for 60 of 90 victims, so treat this as the shape of the targeting rather than a full census.

Has Brain Cipher already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.