CMD
Data as of August 16, 2026.
Credential exposure before the attack
27.3% of CMD victims whose domain we can identify (12 of 44) had employee credentials leak in the 12 months before CMD named them as a victim.
We don't know whether any of these credentials were how CMD gained initial access.
What industries CMD targets
Sector identified for 35 of 44 victims.
| Manufacturing | 7 | |
| Healthcare | 6 | |
| Education | 6 | |
| Construction | 4 | |
| Technology | 3 | |
| Government | 2 | |
| Financial Services | 2 | |
| Energy | 1 |
Where the victims are located
Country identified for 41 of 44 victims.
| United States | 25 | |
| Canada | 5 | |
| Australia | 3 | |
| United Kingdom | 3 | |
| Japan | 1 | |
| India | 1 | |
| South Africa | 1 | |
| Norway | 1 |
Most recent CMD victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Stewart Belland & Associates stewartbellandassociates.ca | Not identified | Canada | Aug 3, 2026 |
| Contact Group contactgroup.com.au | Government | Australia | Jul 31, 2026 |
| Le Mont Notre-Dame lemont.ca | Education | Canada | Jul 31, 2026 |
| Rondout Electric rondoutelectric.net | Construction | United States | Jul 31, 2026 |
| B-K Tool & Design bktool.com | Manufacturing | United States | Jul 29, 2026 |
| Buck Knives buckknives.com | Manufacturing | United States | Jul 29, 2026 |
| T. Simon Jewelers tsimonjewelers.com | Retail | United States | Jul 24, 2026 |
| Saint George\'s School sgs.edu.co | Education | Colombia | Jul 16, 2026 |
| Target Energy Solutions target-energysolutions.com | Technology | Not identified | Jul 15, 2026 |
| Els for Autism Foundation elsforautism.org | Education | United States | Jul 13, 2026 |
| Golden Star Resources gsr.com | Financial Services | United Kingdom | Jul 13, 2026 |
| Finance Yorkshire finance-yorkshire.com | Financial Services | United Kingdom | Jul 10, 2026 |
| Mount Royal University Library mtroyal.ca | Education | Canada | Jul 8, 2026 |
| Medlink Georgia medlinkga.org | Non-profit | United States | Jul 1, 2026 |
| Port Angeles Composite pacomposite.com | Manufacturing | United States | Jul 1, 2026 |
| Lørenskog kommune lorenskog.kommune.no | Government | Norway | Jun 30, 2026 |
| Metco Services metcoservices.com | Construction | United States | Jun 30, 2026 |
| Fidelity Security Group fidelitysecurity.co | Technology | South Africa | Jun 29, 2026 |
| Kohinoor Mills kohinoormills.com | Manufacturing | Not identified | Jun 29, 2026 |
| Coldstat Refrigeration coldstat.com | Not identified | United States | Jun 24, 2026 |
Showing the 20 most recent of 44. Browse recent data breaches for more.
CMD leak sites
Addresses we've seen CMD publish victims from. Any .onion address needs the Tor Browser.
cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onioncmdofficial.comtezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
CMD questions
Is CMD still active?
Yes. CMD posted its most recent victim on August 3, 2026. That's 7 victims in the last 30 days.
How many victims has CMD claimed?
CMD has named 44 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did CMD first appear?
The first victim we recorded for CMD was posted on May 5, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does CMD target?
Manufacturing accounts for the most victims we can classify, with 7. Healthcare follows at 6. We could identify a sector for 35 of 44 victims, so treat this as the shape of the targeting rather than a full census.
Has CMD already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.