Cuba
Data as of August 16, 2026.
Credential exposure before the attack
25.6% of Cuba victims whose domain we can identify (23 of 90) had employee credentials leak in the 12 months before Cuba named them as a victim.
We don't know whether any of these credentials were how Cuba gained initial access.
What industries Cuba targets
Sector identified for 23 of 90 victims.
| Manufacturing | 7 | |
| Education | 4 | |
| Government | 2 | |
| Logistics | 2 | |
| Construction | 2 | |
| Legal | 1 | |
| Energy | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 25 of 90 victims.
| United Kingdom | 4 | |
| Australia | 3 | |
| Germany | 3 | |
| Italy | 2 | |
| Belgium | 2 | |
| Canada | 2 | |
| France | 2 | |
| United States | 2 |
Most recent Cuba victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| DMS Imaging dms-imaging.com | Healthcare | Not identified | Feb 2, 2024 |
| diagnostechs.com | Not identified | Not identified | Nov 15, 2023 |
| portadelaidefc.com.au | Education | Australia | Nov 14, 2023 |
| Prime Art & Jewel prime-art.com | Not identified | Not identified | Nov 8, 2023 |
| New Concept Technology newconcepttech.com | Manufacturing | Not identified | Oct 24, 2023 |
| Mount St. Mary\'s University msmary.edu | Education | Not identified | Oct 11, 2023 |
| rock.wi.us | Not identified | United States | Oct 4, 2023 |
| Gold Medal Bakery goldmedalbakery.com | Manufacturing | Not identified | Aug 21, 2023 |
| Hydrex hydrex.co.uk | Not identified | United Kingdom | Aug 1, 2023 |
| TXM Plant txmplant.co.uk | Not identified | United Kingdom | Aug 1, 2023 |
| addison-il.org | Not identified | Not identified | Jul 12, 2023 |
| Valstybinė Darbo Inspekcija vdi.lt | Government | Lithuania | Jul 12, 2023 |
| The Philadelphia Inquirer inquirer.com | Not identified | Not identified | May 23, 2023 |
| vdi.it | Not identified | Italy | May 11, 2023 |
| gihealthcare.com | Not identified | Not identified | May 5, 2023 |
| Deknudt Frames deknudtframes.be | Not identified | Belgium | Jan 23, 2023 |
| pu.edu.lb | Education | Not identified | Dec 28, 2022 |
| teknowsource.in | Not identified | India | Dec 21, 2022 |
| 2networkit.com | Technology | Not identified | Dec 15, 2022 |
| boss-inc.biz | Not identified | Not identified | Dec 2, 2022 |
Showing the 20 most recent of 90. Browse recent data breaches for more.
Cuba leak sites
Addresses we've seen Cuba publish victims from. Any .onion address needs the Tor Browser.
cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onioni34gbmo5rxx3bxc4yl7f4erkyo2oldwavhpdragnjjvhni6fwvptp2id.onionkcfgfs7cclscxloy3bf2xtwnayimawtzrbfirfbvl47xt7n2brfiizyd.onionlockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
Cuba questions
Is Cuba still active?
Not for over a year. The last victim we recorded was February 2, 2024. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Cuba claimed?
Cuba has named 90 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Cuba first appear?
The first victim we recorded for Cuba was posted on September 14, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Cuba target?
Manufacturing accounts for the most victims we can classify, with 7. Education follows at 4. We could identify a sector for 23 of 90 victims, so treat this as the shape of the targeting rather than a full census.
Has Cuba already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.