Chaos
Data as of August 16, 2026.
Credential exposure before the attack
45% of Chaos victims whose domain we can identify (36 of 80) had employee credentials leak in the 12 months before Chaos named them as a victim.
We don't know whether any of these credentials were how Chaos gained initial access.
What industries Chaos targets
Sector identified for 64 of 80 victims.
| Manufacturing | 18 | |
| Logistics | 11 | |
| Healthcare | 10 | |
| Construction | 8 | |
| Financial Services | 5 | |
| Technology | 3 | |
| Retail | 2 | |
| Energy | 2 |
Where the victims are located
Country identified for 68 of 80 victims.
| United States | 47 | |
| Canada | 10 | |
| Australia | 2 | |
| United Kingdom | 2 | |
| Poland | 2 | |
| Italy | 1 | |
| Germany | 1 | |
| Sweden | 1 |
Most recent Chaos victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Atlantic Tomorrow\'s Office tomorrowsoffice.com | Technology | United States | Aug 6, 2026 |
| Healthcare Highways healthcarehighways.com | Healthcare | United States | Aug 5, 2026 |
| Craneware Group thecranewaregroup.com | Healthcare | United Kingdom | Jul 29, 2026 |
| Vit-Best Nutrition vit-best.com | Manufacturing | United States | Jul 28, 2026 |
| Remco remco.ca | Logistics | Canada | Jul 27, 2026 |
| Servonix Technologies servonix.com | Technology | Canada | Jul 27, 2026 |
| InfoSync issvc.com | Financial Services | United States | Jul 23, 2026 |
| Neopharm Labs neopharmlabs.com | Healthcare | Canada | Jul 23, 2026 |
| Wikoff Color wikoff.com | Manufacturing | United States | Jul 21, 2026 |
| Radia radiax.com | Healthcare | United States | Jul 17, 2026 |
| Aphena Pharma Solutions aphenapharma.com | Healthcare | United States | Jul 15, 2026 |
| Sleeman Breweries sleemanbreweries.ca | Not identified | Canada | Jul 15, 2026 |
| Spectrum Chemical spectrumchemical.com | Healthcare | Not identified | Jul 15, 2026 |
| CorePharma corepharma.com | Healthcare | United States | Jul 9, 2026 |
| Opportune opportune.com | Energy | United States | Jul 9, 2026 |
| Air Creebec aircreebec.ca | Healthcare | Canada | Jul 7, 2026 |
| Grand Isle Shipyard gisy.com | Construction | United States | Jul 7, 2026 |
| Universal Plant Services universalplant.com | Manufacturing | United States | Jul 1, 2026 |
| Ingerman ingerman.com | Construction | United States | Jun 29, 2026 |
| Roof Depot roofdepot.com | Construction | United States | Jun 26, 2026 |
Showing the 20 most recent of 80. Browse recent data breaches for more.
Chaos leak sites
Addresses we've seen Chaos publish victims from. Any .onion address needs the Tor Browser.
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onionqf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onionmyz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onionk6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.oniongenesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onioneen55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onions2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onionbna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onionhttj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onion
Chaos questions
Is Chaos still active?
Yes. Chaos posted its most recent victim on August 6, 2026. That's 10 victims in the last 30 days.
How many victims has Chaos claimed?
Chaos has named 80 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 70 of them were posted in the last 12 months.
When did Chaos first appear?
The first victim we recorded for Chaos was posted on January 6, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Chaos target?
Manufacturing accounts for the most victims we can classify, with 18. Logistics follows at 11. We could identify a sector for 64 of 80 victims, so treat this as the shape of the targeting rather than a full census.
Has Chaos already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.