Chaos

Active
92 victims named on the leak site
12 in the last 30 days
78 in the last 12 months
Jan 2025 first victim we recorded
Sep 15, 2026 most recent victim posted
10 leak sites tracked

Data as of September 15, 2026.

Credential exposure before the attack

43.5% of Chaos victims whose domain we can identify (40 of 92) had employee credentials leak in the 12 months before Chaos named them as a victim.

We don't know whether any of these credentials were how Chaos gained initial access.

What industries Chaos targets

Sector identified for 74 of 92 victims.

Manufacturing24
Healthcare12
Logistics11
Construction9
Financial Services5
Technology3
Energy2
Retail2

Where the victims are located

Country identified for 80 of 92 victims.

United States56
Canada13
Poland2
Australia2
United Kingdom2
Sweden1
India1
Italy1

Most recent Chaos victims

VictimSectorCountryPosted
Glasfloss Industries glasfloss.comManufacturingUnited StatesSep 15, 2026
Steelhaus Technologies steelhausinc.comManufacturingCanadaSep 15, 2026
ArtiFlex Manufacturing artiflexmfg.comManufacturingUnited StatesSep 11, 2026
Mankato Clinic mankatoclinic.comHealthcareUnited StatesSep 11, 2026
Cope Plastics copeplastics.comNot identifiedUnited StatesSep 9, 2026
Evergen evergenbio.comManufacturingUnited StatesSep 7, 2026
Core Materials corematerials.comManufacturingUnited StatesAug 31, 2026
MacAllister Machinery macallister.comConstructionUnited StatesAug 31, 2026
Singleton Urquhart Reynolds Vogel singleton.comLegalCanadaAug 28, 2026
Central Ohio Primary Care copcp.comHealthcareUnited StatesAug 26, 2026
M.S. Walker mswalker.comNot identifiedUnited StatesAug 26, 2026
Park Derochie parkderochie.comManufacturingCanadaAug 26, 2026
Atlantic Tomorrow\'s Office tomorrowsoffice.comTechnologyUnited StatesAug 6, 2026
Healthcare Highways healthcarehighways.comHealthcareUnited StatesAug 5, 2026
Craneware Group thecranewaregroup.comHealthcareUnited KingdomJul 29, 2026
Vit-Best Nutrition vit-best.comManufacturingUnited StatesJul 28, 2026
Remco remco.caLogisticsCanadaJul 27, 2026
Servonix Technologies servonix.comTechnologyCanadaJul 27, 2026
InfoSync issvc.comFinancial ServicesUnited StatesJul 23, 2026
Neopharm Labs neopharmlabs.comHealthcareCanadaJul 23, 2026

Showing the 20 most recent of 92. Browse recent data breaches for more.

Chaos leak sites

Addresses we've seen Chaos publish victims from. Any .onion address needs the Tor Browser.

  • hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion
  • qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion
  • k6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.onion
  • myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion
  • httj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onion
  • 2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onion
  • een55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onion
  • s2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onion
  • bna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onion
  • genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion

Chaos questions

Is Chaos still active?

Yes. Chaos posted its most recent victim on September 15, 2026. That's 12 victims in the last 30 days.

How many victims has Chaos claimed?

Chaos has named 92 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 78 of them were posted in the last 12 months.

When did Chaos first appear?

The first victim we recorded for Chaos was posted on January 6, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Chaos target?

Manufacturing accounts for the most victims we can classify, with 24. Healthcare follows at 12. We could identify a sector for 74 of 92 victims, so treat this as the shape of the targeting rather than a full census.

Has Chaos already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.