Chaos

Active
95 victims named on the leak site
9 in the last 30 days
81 in the last 12 months
Jan 2025 first victim we recorded
Sep 30, 2026 most recent victim posted
10 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

44.2% of Chaos victims whose domain we can identify (42 of 95) had employee credentials leak in the 12 months before Chaos named them as a victim.

We don't know whether any of these credentials were how Chaos gained initial access.

What industries Chaos targets

Sector identified for 75 of 95 victims.

Manufacturing24
Healthcare13
Logistics11
Construction9
Financial Services5
Technology3
Energy2
Retail2

Where the victims are located

Country identified for 82 of 95 victims.

United States58
Canada13
United Kingdom2
Poland2
Australia2
Germany1
Sweden1
India1

Most recent Chaos victims

VictimSectorCountryPosted
Advantech advantech.comNot identifiedNot identifiedSep 30, 2026
Carolina Asthma & Allergy Center carolinaasthma.comHealthcareUnited StatesSep 30, 2026
Express Employment Professionals expresspros.comNot identifiedUnited StatesSep 18, 2026
Glasfloss Industries glasfloss.comManufacturingUnited StatesSep 15, 2026
Steelhaus Technologies steelhausinc.comManufacturingCanadaSep 15, 2026
ArtiFlex Manufacturing artiflexmfg.comManufacturingUnited StatesSep 11, 2026
Mankato Clinic mankatoclinic.comHealthcareUnited StatesSep 11, 2026
Cope Plastics copeplastics.comNot identifiedUnited StatesSep 9, 2026
Evergen evergenbio.comManufacturingUnited StatesSep 7, 2026
Core Materials corematerials.comManufacturingUnited StatesAug 31, 2026
MacAllister Machinery macallister.comConstructionUnited StatesAug 31, 2026
Singleton Urquhart Reynolds Vogel singleton.comLegalCanadaAug 28, 2026
Central Ohio Primary Care copcp.comHealthcareUnited StatesAug 26, 2026
M.S. Walker mswalker.comNot identifiedUnited StatesAug 26, 2026
Park Derochie parkderochie.comManufacturingCanadaAug 26, 2026
Atlantic Tomorrow\'s Office tomorrowsoffice.comTechnologyUnited StatesAug 6, 2026
Healthcare Highways healthcarehighways.comHealthcareUnited StatesAug 5, 2026
Craneware Group thecranewaregroup.comHealthcareUnited KingdomJul 29, 2026
Vit-Best Nutrition vit-best.comManufacturingUnited StatesJul 28, 2026
Remco remco.caLogisticsCanadaJul 27, 2026

Showing the 20 most recent of 95. Browse recent data breaches for more.

Chaos leak sites

Addresses we've seen Chaos publish victims from. Any .onion address needs the Tor Browser.

  • hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion
  • qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion
  • myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion
  • k6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.onion
  • genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion
  • 2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onion
  • een55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onion
  • s2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onion
  • bna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onion
  • httj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onion

Chaos questions

Is Chaos still active?

Yes. Chaos posted its most recent victim on September 30, 2026. That's 9 victims in the last 30 days.

How many victims has Chaos claimed?

Chaos has named 95 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 81 of them were posted in the last 12 months.

When did Chaos first appear?

The first victim we recorded for Chaos was posted on January 6, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Chaos target?

Manufacturing accounts for the most victims we can classify, with 24. Healthcare follows at 13. We could identify a sector for 75 of 95 victims, so treat this as the shape of the targeting rather than a full census.

Has Chaos already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.