DeadLock
Data as of September 15, 2026.
Credential exposure before the attack
11.3% of DeadLock victims whose domain we can identify (13 of 115) had employee credentials leak in the 12 months before DeadLock named them as a victim.
We don't know whether any of these credentials were how DeadLock gained initial access.
What industries DeadLock targets
Sector identified for 88 of 115 victims.
| Manufacturing | 30 | |
| Financial Services | 10 | |
| Construction | 10 | |
| Technology | 6 | |
| Healthcare | 6 | |
| Government | 5 | |
| Logistics | 5 | |
| Automotive | 3 |
Where the victims are located
Country identified for 108 of 115 victims.
| Spain | 15 | |
| Italy | 15 | |
| Poland | 11 | |
| United States | 6 | |
| Turkey | 6 | |
| France | 4 | |
| Portugal | 3 | |
| Mexico | 3 |
Most recent DeadLock victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Furniture Bargaining Council furnbed.co.za | Not identified | South Africa | Aug 25, 2026 |
| Shaheen Law Firm shaheenlaw.com | Legal | United States | Aug 25, 2026 |
| JP Molyneux Studio molyneuxstudio.com | Not identified | France | Aug 21, 2026 |
| Global Terminal Services globalterminal-tr.com | Energy | Turkey | Aug 12, 2026 |
| LT Group ltg.com.ph | Financial Services | Philippines | Aug 11, 2026 |
| K&A Machmouchi Pharma kamph.co | Healthcare | Colombia | Aug 3, 2026 |
| United Fiber Optic Communication ufoc.com.tw | Manufacturing | Taiwan | Aug 3, 2026 |
| Western Union westernunion.gr | Financial Services | United States | Jul 30, 2026 |
| Ahenk Laboratuvarı ahenklab.com.tr | Healthcare | Turkey | Jul 29, 2026 |
| DIATER diater.com | Not identified | Spain | Jul 29, 2026 |
| Pasello Trattamenti Termici pasello.com | Manufacturing | Italy | Jul 29, 2026 |
| Takis Biotech takisbiotech.it | Not identified | Italy | Jul 29, 2026 |
| Hardware Asesorias Software hasltda.com | Technology | Colombia | Jul 28, 2026 |
| Tesco Engineers tesco-engineers.com | Construction | Thailand | Jul 28, 2026 |
| Caspian One caspianone.com | Financial Services | United Kingdom | Jul 27, 2026 |
| High Class highclasscarlimo.com | Healthcare | United States | Jul 27, 2026 |
| West African Resources westafricanresources.com | Not identified | Australia | Jul 27, 2026 |
| Aldaco Avance 2022 aldacogrupoavance.es | Construction | Spain | Jul 13, 2026 |
| BioResearch Group bioresearch.pl | Not identified | Poland | Jul 13, 2026 |
| Carrier Transport carrier.se | Energy | Sweden | Jul 13, 2026 |
Showing the 20 most recent of 115. Browse recent data breaches for more.
DeadLock leak sites
Addresses we've seen DeadLock publish victims from. Any .onion address needs the Tor Browser.
deadlock.liveblog365.comdeadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion
DeadLock questions
Is DeadLock still active?
Yes. DeadLock posted its most recent victim on August 25, 2026. That's 3 victims in the last 30 days.
How many victims has DeadLock claimed?
DeadLock has named 115 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did DeadLock first appear?
The first victim we recorded for DeadLock was posted on June 10, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does DeadLock target?
Manufacturing accounts for the most victims we can classify, with 30. Financial Services follows at 10. We could identify a sector for 88 of 115 victims, so treat this as the shape of the targeting rather than a full census.
Has DeadLock already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.