CL0P

Active
Also tracked as CLOP
1,514 victims named on the leak site
44 in the last 30 days
259 in the last 12 months
Oct 2021 first victim we recorded
Aug 14, 2026 most recent victim posted
25 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

44.1% of CL0P victims whose domain we can identify (668 of 1,514) had employee credentials leak in the 12 months before CL0P named them as a victim.

We don't know whether any of these credentials were how CL0P gained initial access.

What industries CL0P targets

Sector identified for 804 of 1,514 victims.

Manufacturing208
Financial Services118
Technology88
Healthcare82
Logistics75
Energy38
Education37
Retail35

Where the victims are located

Country identified for 470 of 1,514 victims.

United States190
Canada60
United Kingdom48
Australia27
Germany14
India13
France12
Italy9

Most recent CL0P victims

VictimSectorCountryPosted
Zebra Technologies zebra.comManufacturingUnited StatesAug 14, 2026
9altitudes 9altitudes.comTechnologyBelgiumAug 13, 2026
Aldo Group aldogroup.comRetailCanadaAug 13, 2026
ArcherGrey archergrey.comTechnologyUnited StatesAug 13, 2026
Atomberg atomberg.comManufacturingIndiaAug 13, 2026
Brillon Consumer Products brillonconsumer.comManufacturingIndiaAug 13, 2026
Clover clover.comNot identifiedUnited StatesAug 13, 2026
Cornelius cornelius.comManufacturingUnited StatesAug 13, 2026
Eccellent Solutions eccellent.comTechnologyUnited StatesAug 13, 2026
Fiserv fiserv.comFinancial ServicesUnited StatesAug 13, 2026
FluidLogic fluidlogic.comManufacturingUnited StatesAug 13, 2026
G3 Aerospace g3aerospace.comManufacturingUnited StatesAug 13, 2026
General Electric ge.comManufacturingUnited StatesAug 13, 2026
Honghe Technology honghe-tech.comManufacturingChinaAug 13, 2026
Intelligent Growth Solutions intelligentgrowthsolutions.comTechnologyUnited KingdomAug 13, 2026
Intellihot intellihot.comManufacturingUnited StatesAug 13, 2026
IPM Solutions ipmsolutions.skTechnologySlovakiaAug 13, 2026
IRCO Automation irco.comManufacturingSwedenAug 13, 2026
ITK Holding itkholding.huManufacturingHungaryAug 13, 2026
iValue Group ivaluesys.comTechnologyIndiaAug 13, 2026

Showing the 20 most recent of 1,514. Browse recent data breaches for more.

CL0P leak sites

Addresses we've seen CL0P publish victims from. Any .onion address needs the Tor Browser.

  • amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion
  • qahjimrublt35jlv4teesicrw6zhpwhkb6nhtonwxuqafmjhr7hax2id.onion
  • 2vi357dgf4246nvrcsavrt5jsrm7pfqim4t2n3ykzedjim5bzqezmlyd.onion
  • l4rdimrqyonulqjttebry4t6wuzgjv5m62rnpjho3q22a6maf6d5evyd.onion
  • frgp3f3u2ddafv4ny7tqn6tc674m6fyymyywoaxot7xskbjmiyhhsyqd.onion
  • 3ws3t4uo7fehnn4qpmadk3zjrxta5xlt3gsc5mx4sztrsy7ficuz5ayd.onion
  • santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
  • bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion
  • toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
  • ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion
  • b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion
  • p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion
  • whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion
  • x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion
  • ekbgzchl6x2ias37.onion
  • amnwxasjtjc6e42siac6t45mhbkgtycrchuayd.onion
  • alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion
  • amnwxasjtjc6e42siac6t5mhbkgtycrx5krv7sf5festvqxmnchuayd.onion
  • amnwxasjtjc6e42siac6t45mhbktycrx5krv7sf5festvqxmnchuayd.onion
  • amnwxastjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion
  • amnwxasjtjc6e42sia6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion
  • bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onion
  • bashed52orwi7qoyvmcfkdnuaogta4inpojfd6cthzkp4qpsq64ux4ad.onion
  • bashedl53memptddxzb4kr5mnkzse4fmhpqeq7jb4srndswar46nofid.onion
  • bashefe5uezp2jtxpk24b2pyfnnfyguicgrgqufgu57mfluegotbeayd.onion

CL0P questions

Is CL0P still active?

Yes. CL0P posted its most recent victim on August 14, 2026. That's 44 victims in the last 30 days.

How many victims has CL0P claimed?

CL0P has named 1,514 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 259 of them were posted in the last 12 months.

When did CL0P first appear?

The first victim we recorded for CL0P was posted on October 5, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does CL0P target?

Manufacturing accounts for the most victims we can classify, with 208. Financial Services follows at 118. We could identify a sector for 804 of 1,514 victims, so treat this as the shape of the targeting rather than a full census.

Has CL0P already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.