CipherForce
Data as of August 16, 2026.
What industries CipherForce targets
Sector identified for 10 of 19 victims.
| Technology | 3 | |
| Logistics | 2 | |
| Financial Services | 2 | |
| Telecommunications | 1 | |
| Retail | 1 | |
| Manufacturing | 1 |
Where the victims are located
Country identified for 16 of 19 victims.
| United States | 5 | |
| China | 3 | |
| Vietnam | 1 | |
| United Arab Emirates | 1 | |
| South Korea | 1 | |
| Philippines | 1 | |
| Chile | 1 | |
| Canada | 1 |
Every CipherForce victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| BMW Group bmwgroup.com | Manufacturing | Germany | Mar 27, 2026 |
| Sportradar sportradar.io | Not identified | Switzerland | Mar 27, 2026 |
| Tuna tuna.uy | Not identified | Not identified | Mar 24, 2026 |
| Liberty Tax Canada libertytaxcanada.ca | Financial Services | Canada | Mar 16, 2026 |
| Biaodianyun biaodianyun.cn | Not identified | China | Mar 12, 2026 |
| GetRentacar getrentacar.com | Logistics | Not identified | Mar 12, 2026 |
| Insight Systems insightsystems.io | Technology | United States | Mar 12, 2026 |
| JobKorea jobkorea.co.kr | Not identified | South Korea | Mar 12, 2026 |
| Telcom Live Content mobilemoney.ph | Financial Services | Philippines | Mar 12, 2026 |
| ProLiga proliga.uz | Not identified | Not identified | Mar 12, 2026 |
| SafePlusPay safepluspay.com | Not identified | China | Mar 12, 2026 |
| TriCounty Telephone Association tctelco.net | Telecommunications | United States | Mar 12, 2026 |
| Tumin tumin.cl | Retail | Chile | Mar 12, 2026 |
| Accuick accuick.com | Technology | United States | Feb 24, 2026 |
| Biaodianyun Group baijiayun.com | Not identified | China | Feb 24, 2026 |
| FindNear findnear.com | Not identified | Vietnam | Feb 24, 2026 |
| Hiring Steps hiringsteps.com | Not identified | United States | Feb 24, 2026 |
| Tektree tektreeinc.com | Technology | United States | Feb 24, 2026 |
| Zip24 zip24.com | Logistics | United Arab Emirates | Feb 24, 2026 |
Browse recent data breaches for more.
CipherForce leak sites
Addresses we've seen CipherForce publish victims from. Any .onion address needs the Tor Browser.
22evxpggnkyrxpluewqsrv5j4jtde6hut2peq3w44d6ase676qlkoead.oniono3ydbkayttkyg4iw2nc732jxmmex25bjeyqyvuuyngnxmpehdefjr3qd.onion
CipherForce questions
Is CipherForce still active?
It's gone quiet. The last victim we recorded was March 27, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has CipherForce claimed?
CipherForce has named 19 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did CipherForce first appear?
The first victim we recorded for CipherForce was posted on February 24, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does CipherForce target?
Technology accounts for the most victims we can classify, with 3. Logistics follows at 2. We could identify a sector for 10 of 19 victims, so treat this as the shape of the targeting rather than a full census.
Has CipherForce already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.