Cloak

Active

76 victims named on the leak site

0 in the last 30 days

5 in the last 12 months

Apr 2023 first victim we recorded

Jun 19, 2026 most recent victim posted

25 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

19.7% of Cloak victims whose domain we can identify (15 of 76) had employee credentials leak in the 12 months before Cloak named them as a victim.

We don't know whether any of these credentials were how Cloak gained initial access.

What industries Cloak targets

Sector identified for 43 of 76 victims.

Manufacturing	7
Healthcare	7
Financial Services	6
Government	4
Legal	4
Construction	3
Automotive	2
Energy	2

Where the victims are located

Country identified for 40 of 76 victims.

Germany	18
United States	5
Taiwan	2
France	2
Italy	2
United Kingdom	2
Peru	2
United Arab Emirates	1

Most recent Cloak victims

Victim	Sector	Country	Posted
Vogeler Rechtsanwälte ra-vogeler.de	Legal	Germany	Jun 19, 2026
City of Suffolk suffolkva.us	Government	United States	Feb 25, 2026
Autohaus Dinnebier dinnebiergruppe.de	Automotive	Germany	Feb 19, 2026
BDO Peru bdo.com.pe	Financial Services	Peru	Sep 1, 2025
Tufts Medicine tuftsmedicine.org	Healthcare	United States	Sep 1, 2025
H&H WSTG Wirtschafts wstg-steuerberater.de	Financial Services	Germany	Aug 11, 2025
Production Saw and Machine productionsaw.com	Manufacturing	Not identified	Jun 9, 2025
Department of Pensions in Sri Lanka pensions.gov.lk	Government	Not identified	May 28, 2025
The Newtron Group thenewtrongroup.com	Manufacturing	Not identified	May 7, 2025
Bosshard-Farben bosshard-farben.ch	Not identified	Switzerland	Apr 3, 2025
Baltimore City Public Schools baltimorecityschools.org	Not identified	Not identified	Mar 21, 2025
Office of the Attorney General state.va.us	Legal	United States	Mar 21, 2025
Wülfing Zeuner Rechel wr-recht.de	Legal	Germany	Mar 21, 2025
Waggoner waggonereng.com	Construction	United States	Jan 31, 2025
Centro Medico ENOVA centromedicoenova.com	Healthcare	Spain	Jan 31, 2025
Premier Auto Credit premierautocredit.com	Not identified	Not identified	Jan 30, 2025
Gemeinde Kaisersbach kaisersbach.de	Education	Germany	Jan 29, 2025
Neovita neovita.de	Not identified	Germany	Jan 29, 2025
Bankwell Financial Group bwfg.at	Financial Services	Austria	Jan 24, 2025
Fitzpatrick Hotel Group fitzpatrickhotels.com	Hospitality	United States	Jan 2, 2025

Showing the 20 most recent of 76. Browse recent data breaches for more.

Cloak leak sites

Addresses we've seen Cloak publish victims from. Any .onion address needs the Tor Browser.

cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion
37izr5yow5d673agew22miyy3inbqncuv7gfp5372yciuzvadqef66yd.onion
wppln24jtowm4trp7sya454746alxr7xmpy7d3vdpjbbrwijp2lsslqd.onion
hmxt5u75kj5qxqjqhckgaoda6zndgxcazleersyioat4iuq3ldgmkcid.onion
a6gq22ngckken4xksz5ytl66sqeylh45ktke5pnbzfdksw5sfum5lvqd.onion
incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
akcgmwyuuxdik3v6fkazcmvjpvn6pydk6uhk7ugnphk6rvqrw4347mid.onion
l3bbtg2p2gp2x43e2nngzkf7ab52k4mef3saowrl6m5notkts7p2vfyd.onion
q5dlfpubgz5c2bquwbbeadarls3mvoyozerxjztne2urlx5ucjjsnzqd.onion
heac3upmfv33scnkeek64dqdx2cblv7z256aezluyvgtwsxi2o3coiid.onion
ljrswxeei4isir3s5i7xmlzpx6sabmkgd7mvjrimcqwu7rqpn7bdjfad.onion
qixf7fqw237ikunw4ey22jsc4deltducf6zn4mq4ldyqab3ij3gehlyd.onion
am3mzzguimx45wxywpukvwf3gobt3r4bidxzntjpsmqqge4s3vi2vvid.onion
ziburuf5kh4phq5i6nmukpke7uruflhlvfexfmjwiwgghapz6ug3ajyd.onion
jrmayo7rvsx6sbv36djpdge6iwuem67dhccpctera2ykmqr6kplhayad.onion
twt3uqwcwkcjfauqpcbvggnfuyxwnfob55q2j5e2bjsg5hcss2qzcrid.onion
sclj2rax5ljisew3v4msecylzo7iieqw25kcl7io4szei4qcujxixaid.onion
cii64fki62v2mudocjvgarzlmnpqrfp6xb7korapmdd7qmjpnccgduyd.onion
jtfv3hqhd4ozsxsefigrpiev6lnykbdmshrz3vaw7ye7eapup7y4jtqd.onion
greev7tjvttdxk3h6p5a4r7uked5tvizcauncaglu4y2vxbwodjtirqd.onion
d6fp2wh2solvhvzbrz7yraw47cctqntnwtfrjaucdw62sz7pt3hqpwyd.onion
nbfxtlikrnicuht5yvvhlujpnh3spzjmek6eujeyck2ws34yytxjdhyd.onion
ey2eak3vq5zbeu4s56m25mm4kvszy2is7gyjs6tsfzmhptbyijkzn2yd.onion
ztqugnw4upfmd6mu3l6sdz2mfvzxzouhwgqqowyjeedgsmz733dqq2ad.onion
jpef6snenchj3rxgugsozky3i34q66vmcoqy7neyu37xxiwxrad5doid.onion

Cloak questions

Is Cloak still active?

Yes. Cloak posted its most recent victim on June 19, 2026.

How many victims has Cloak claimed?

Cloak has named 76 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 5 of them were posted in the last 12 months.

When did Cloak first appear?

The first victim we recorded for Cloak was posted on April 30, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Cloak target?

Manufacturing accounts for the most victims we can classify, with 7. Healthcare follows at 7. We could identify a sector for 43 of 76 victims, so treat this as the shape of the targeting rather than a full census.

Has Cloak already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.