CL0P

Active
Also tracked as CLOP
1,516 victims named on the leak site
2 in the last 30 days
261 in the last 12 months
Oct 2021 first victim we recorded
Sep 10, 2026 most recent victim posted
25 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

44.3% of CL0P victims whose domain we can identify (671 of 1,516) had employee credentials leak in the 12 months before CL0P named them as a victim.

We don't know whether any of these credentials were how CL0P gained initial access.

What industries CL0P targets

Sector identified for 807 of 1,516 victims.

Manufacturing211
Financial Services119
Technology88
Healthcare82
Logistics75
Energy38
Education37
Retail34

Where the victims are located

Country identified for 474 of 1,516 victims.

United States193
Canada60
United Kingdom48
Australia27
Germany14
India13
France12
Mexico10

Most recent CL0P victims

VictimSectorCountryPosted
Harley-Davidson harley-davidson.comManufacturingUnited StatesSep 10, 2026
Henry Pratt henrypratt.comManufacturingUnited StatesSep 10, 2026
Zebra Technologies zebra.comManufacturingUnited StatesAug 14, 2026
9altitudes 9altitudes.comTechnologyBelgiumAug 13, 2026
Aldo Group aldogroup.comRetailCanadaAug 13, 2026
ArcherGrey archergrey.comTechnologyUnited StatesAug 13, 2026
Atomberg atomberg.comManufacturingIndiaAug 13, 2026
Brillon Consumer Products brillonconsumer.comManufacturingIndiaAug 13, 2026
Clover clover.comNot identifiedUnited StatesAug 13, 2026
Cornelius cornelius.comManufacturingUnited StatesAug 13, 2026
Eccellent Solutions eccellent.comTechnologyUnited StatesAug 13, 2026
Fiserv fiserv.comFinancial ServicesUnited StatesAug 13, 2026
FluidLogic fluidlogic.comManufacturingUnited StatesAug 13, 2026
G3 Aerospace g3aerospace.comManufacturingUnited StatesAug 13, 2026
General Electric ge.comManufacturingUnited StatesAug 13, 2026
Honghe Technology honghe-tech.comManufacturingChinaAug 13, 2026
Intelligent Growth Solutions intelligentgrowthsolutions.comTechnologyUnited KingdomAug 13, 2026
Intellihot intellihot.comManufacturingUnited StatesAug 13, 2026
IPM Solutions ipmsolutions.skTechnologySlovakiaAug 13, 2026
IRCO Automation irco.comManufacturingSwedenAug 13, 2026

Showing the 20 most recent of 1,516. Browse recent data breaches for more.

CL0P leak sites

Addresses we've seen CL0P publish victims from. Any .onion address needs the Tor Browser.

  • amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion
  • qahjimrublt35jlv4teesicrw6zhpwhkb6nhtonwxuqafmjhr7hax2id.onion
  • 2vi357dgf4246nvrcsavrt5jsrm7pfqim4t2n3ykzedjim5bzqezmlyd.onion
  • l4rdimrqyonulqjttebry4t6wuzgjv5m62rnpjho3q22a6maf6d5evyd.onion
  • frgp3f3u2ddafv4ny7tqn6tc674m6fyymyywoaxot7xskbjmiyhhsyqd.onion
  • 3ws3t4uo7fehnn4qpmadk3zjrxta5xlt3gsc5mx4sztrsy7ficuz5ayd.onion
  • santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
  • bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion
  • toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
  • b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion
  • p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion
  • whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion
  • x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion
  • ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion
  • ekbgzchl6x2ias37.onion
  • mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
  • amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmncuayd.onion
  • amnwxasjtjc6e42siac6t45mhbkgtycx5krv7sf5festvqxmnchuayd.onion
  • amnwxasjtjc6e42siac6t45mhbkgtycrchuayd.onion
  • alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion
  • bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onion
  • bashed52orwi7qoyvmcfkdnuaogta4inpojfd6cthzkp4qpsq64ux4ad.onion
  • bashedl53memptddxzb4kr5mnkzse4fmhpqeq7jb4srndswar46nofid.onion
  • bashefe5uezp2jtxpk24b2pyfnnfyguicgrgqufgu57mfluegotbeayd.onion
  • bashei5oy4zvmf2letnupwhgprdkjyssm3zxj2oyr6wfezkf3elehzqd.onion

CL0P questions

Is CL0P still active?

Yes. CL0P posted its most recent victim on September 10, 2026. That's 2 victims in the last 30 days.

How many victims has CL0P claimed?

CL0P has named 1,516 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 261 of them were posted in the last 12 months.

When did CL0P first appear?

The first victim we recorded for CL0P was posted on October 5, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does CL0P target?

Manufacturing accounts for the most victims we can classify, with 211. Financial Services follows at 119. We could identify a sector for 807 of 1,516 victims, so treat this as the shape of the targeting rather than a full census.

Has CL0P already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.