DarkVault
Data as of August 16, 2026.
Credential exposure before the attack
21.2% of DarkVault victims whose domain we can identify (11 of 52) had employee credentials leak in the 12 months before DarkVault named them as a victim.
We don't know whether any of these credentials were how DarkVault gained initial access.
What industries DarkVault targets
Sector identified for 17 of 52 victims.
| Logistics | 4 | |
| Retail | 3 | |
| Manufacturing | 2 | |
| Technology | 2 | |
| Education | 2 | |
| Real Estate | 1 | |
| Financial Services | 1 | |
| Healthcare | 1 |
Where the victims are located
Country identified for 24 of 52 victims.
| Brazil | 5 | |
| United Kingdom | 3 | |
| Israel | 2 | |
| United States | 2 | |
| India | 2 | |
| Mexico | 2 | |
| United Arab Emirates | 1 | |
| Croatia | 1 |
Most recent DarkVault victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Yoniot yoniot.cn | Not identified | China | Jan 7, 2025 |
| ConfluxHR confluxhr.com | Technology | Not identified | Jan 3, 2025 |
| Timely.mn timely.mn | Not identified | Not identified | Dec 29, 2024 |
| SalesGig salesgig.com | Not identified | Not identified | Dec 3, 2024 |
| TCI textilescoated.com | Manufacturing | United States | Dec 3, 2024 |
| InThinking inthinking.net | Not identified | Not identified | Nov 21, 2024 |
| Arabot arabot.io | Not identified | Not identified | Nov 20, 2024 |
| Techguard techguard.in | Not identified | India | Nov 20, 2024 |
| Nejoum Aljazeera naj.ae | Logistics | United States | Nov 8, 2024 |
| Fresh Aire Franchise freshairefranchise.com | Not identified | Not identified | Aug 29, 2024 |
| PocketRisk pocketrisk.com | Not identified | Not identified | Aug 27, 2024 |
| INGOT Brokers ingotbrokers.com | Not identified | Not identified | Aug 26, 2024 |
| PeopleWell peoplewell.com | Healthcare | Not identified | Aug 19, 2024 |
| Mega Travel megatravel.com.mx | Not identified | Mexico | Aug 16, 2024 |
| Glazkov glazkov.co.il | Financial Services | Israel | Aug 14, 2024 |
| Gauteng Partnership Fund gpf.org.za | Not identified | South Africa | Aug 14, 2024 |
| ComOferta comoferta.com | Retail | Not identified | Aug 8, 2024 |
| Mercado Mineiro mercadomineiro.com.br | Retail | Brazil | Aug 8, 2024 |
| Warrendale Wagyu warrendale-wagyu.co.uk | Not identified | United Kingdom | Aug 2, 2024 |
| Blankstyle blankstyle.com | Not identified | Not identified | Jul 29, 2024 |
Showing the 20 most recent of 52. Browse recent data breaches for more.
DarkVault leak sites
Addresses we've seen DarkVault publish victims from. Any .onion address needs the Tor Browser.
mdhby62yvvg6sd5jmx5gsyucs7ynb5j45lvvdh4dsymg43puitu7tfid.onionlynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onioncactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion
DarkVault questions
Is DarkVault still active?
Not for over a year. The last victim we recorded was January 7, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has DarkVault claimed?
DarkVault has named 52 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did DarkVault first appear?
The first victim we recorded for DarkVault was posted on April 16, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does DarkVault target?
Logistics accounts for the most victims we can classify, with 4. Retail follows at 3. We could identify a sector for 17 of 52 victims, so treat this as the shape of the targeting rather than a full census.
Has DarkVault already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.