CiphBit
Data as of August 16, 2026.
Credential exposure before the attack
12.9% of CiphBit victims whose domain we can identify (4 of 31) had employee credentials leak in the 12 months before CiphBit named them as a victim.
We don't know whether any of these credentials were how CiphBit gained initial access.
What industries CiphBit targets
Sector identified for 20 of 31 victims.
| Manufacturing | 5 | |
| Healthcare | 3 | |
| Financial Services | 3 | |
| Logistics | 2 | |
| Telecommunications | 2 | |
| Energy | 1 | |
| Government | 1 | |
| Education | 1 |
Where the victims are located
Country identified for 17 of 31 victims.
| Italy | 5 | |
| France | 3 | |
| Belgium | 1 | |
| United Kingdom | 1 | |
| Netherlands | 1 | |
| Portugal | 1 | |
| United States | 1 | |
| Austria | 1 |
Most recent CiphBit victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Clínica Villa Zaita clinicavillazaita.com | Healthcare | Not identified | Dec 2, 2025 |
| Church of the Ascension ascensionlondon.com | Education | Canada | Nov 27, 2025 |
| Bader Gruppe badergruppe.com | Manufacturing | Germany | Oct 27, 2025 |
| Commune de Corneilhan corneilhan.fr | Government | France | Oct 27, 2025 |
| Jimfor jimfor.com | Financial Services | Not identified | Oct 27, 2025 |
| IP Telecom iptelecom.at | Telecommunications | Austria | May 28, 2025 |
| Therma Seal Insulation Systems thermaseal.net | Energy | Not identified | Feb 13, 2025 |
| Kitevuc kitevuc.com | Not identified | Not identified | Jan 2, 2025 |
| Pergher Notariat advokatur-bl.ch | Real Estate | Switzerland | Dec 27, 2024 |
| António Belém & António Gonçalves abag-sroc.pt | Not identified | Portugal | Dec 14, 2024 |
| AXEON 360 axeon-360.com | Hospitality | Not identified | Nov 14, 2024 |
| CopySmart copysmart.us | Not identified | United States | Oct 7, 2024 |
| Southern Fire southernfiresprinkler.com | Not identified | Not identified | Sep 30, 2024 |
| Luigi Convertini luigiconvertini.it | Not identified | Italy | Aug 22, 2024 |
| Keios keios.it | Not identified | Italy | Aug 19, 2024 |
| FD Automation fdsrl.it | Manufacturing | Italy | Aug 16, 2024 |
| TrueNet Communications truenetcommunications.com | Telecommunications | Not identified | Apr 18, 2024 |
| Macuz macuz.it | Not identified | Italy | Apr 9, 2024 |
| Termoplastic termoplastic.it | Manufacturing | Italy | Apr 8, 2024 |
| Commerce Dental Group commercedentistry.com | Healthcare | Not identified | Apr 5, 2024 |
Showing the 20 most recent of 31. Browse recent data breaches for more.
CiphBit leak site
The address we've seen CiphBit publish victims from. Any .onion address needs the Tor Browser.
ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion
CiphBit questions
Is CiphBit still active?
It's gone quiet. The last victim we recorded was December 2, 2025, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has CiphBit claimed?
CiphBit has named 31 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 5 of them were posted in the last 12 months.
When did CiphBit first appear?
The first victim we recorded for CiphBit was posted on September 18, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does CiphBit target?
Manufacturing accounts for the most victims we can classify, with 5. Healthcare follows at 3. We could identify a sector for 20 of 31 victims, so treat this as the shape of the targeting rather than a full census.
Has CiphBit already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.