CRPxO
Data as of August 16, 2026.
Credential exposure before the attack
8.9% of CRPxO victims whose domain we can identify (4 of 45) had employee credentials leak in the 12 months before CRPxO named them as a victim.
We don't know whether any of these credentials were how CRPxO gained initial access.
What industries CRPxO targets
Sector identified for 36 of 45 victims.
| Financial Services | 12 | |
| Healthcare | 11 | |
| Manufacturing | 3 | |
| Legal | 3 | |
| Non-profit | 1 | |
| Real Estate | 1 | |
| Hospitality | 1 | |
| Technology | 1 |
Where the victims are located
Country identified for 43 of 45 victims.
| United States | 32 | |
| Turkey | 8 | |
| China | 1 | |
| Australia | 1 | |
| Canada | 1 |
Most recent CRPxO victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| A101 a101.com.tr | Retail | Turkey | Aug 3, 2026 |
| Anadolubank anadolubank.com.tr | Financial Services | Turkey | Aug 3, 2026 |
| Anadolu Sigorta anadolusigorta.com.tr | Financial Services | Turkey | Aug 3, 2026 |
| Aselsan aselsan.com | Not identified | Not identified | Aug 3, 2026 |
| Doğan doganholding.com.tr | Financial Services | Turkey | Aug 3, 2026 |
| Encore Enterprises encore.bz | Financial Services | United States | Aug 3, 2026 |
| Hyundai Motor Türkiye hyundai.com.tr | Manufacturing | Turkey | Aug 3, 2026 |
| Johnson & Johnson jnj.com | Healthcare | United States | Aug 3, 2026 |
| Kuveyt Türk kuveytturk.com.tr | Financial Services | Turkey | Aug 3, 2026 |
| QNB Bank qnbfinansbank.com | Financial Services | Not identified | Aug 3, 2026 |
| Togg togg.com.tr | Automotive | Turkey | Aug 3, 2026 |
| Turkish Airlines turkishairlines.com | Logistics | Turkey | Aug 3, 2026 |
| American Home Healthcare americanhomehealthservices.com | Healthcare | United States | Jul 28, 2026 |
| Boelte boelte.com | Not identified | United States | Jul 28, 2026 |
| Brightstar Partners Insurance brightstarpartnersins.com | Financial Services | United States | Jul 28, 2026 |
| Code Conductor codeconductor.ai | Not identified | United States | Jul 28, 2026 |
| The Phoenix Dignity Project dignityphoenix.org | Non-profit | United States | Jul 28, 2026 |
| Dinatec dinatec.com | Manufacturing | United States | Jul 28, 2026 |
| E-care Platform ecareplatform.com | Healthcare | United States | Jul 28, 2026 |
| Elko Dental Specialists elkosmiles.com | Healthcare | United States | Jul 28, 2026 |
Showing the 20 most recent of 45. Browse recent data breaches for more.
CRPxO leak site
The address we've seen CRPxO publish victims from. Any .onion address needs the Tor Browser.
crpx0.su
CRPxO questions
Is CRPxO still active?
Yes. CRPxO posted its most recent victim on August 3, 2026. That's 40 victims in the last 30 days.
How many victims has CRPxO claimed?
CRPxO has named 45 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did CRPxO first appear?
The first victim we recorded for CRPxO was posted on July 9, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does CRPxO target?
Financial Services accounts for the most victims we can classify, with 12. Healthcare follows at 11. We could identify a sector for 36 of 45 victims, so treat this as the shape of the targeting rather than a full census.
Has CRPxO already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.