DeadLock
Data as of August 16, 2026.
Credential exposure before the attack
11.6% of DeadLock victims whose domain we can identify (13 of 112) had employee credentials leak in the 12 months before DeadLock named them as a victim.
We don't know whether any of these credentials were how DeadLock gained initial access.
What industries DeadLock targets
Sector identified for 87 of 112 victims.
| Manufacturing | 30 | |
| Financial Services | 10 | |
| Construction | 10 | |
| Technology | 6 | |
| Healthcare | 6 | |
| Government | 5 | |
| Logistics | 5 | |
| Automotive | 3 |
Where the victims are located
Country identified for 105 of 112 victims.
| Spain | 15 | |
| Italy | 15 | |
| Poland | 11 | |
| Turkey | 6 | |
| United States | 5 | |
| Portugal | 3 | |
| Mexico | 3 | |
| Germany | 3 |
Most recent DeadLock victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Global Terminal Services globalterminal-tr.com | Energy | Turkey | Aug 12, 2026 |
| LT Group ltg.com.ph | Financial Services | Philippines | Aug 11, 2026 |
| K&A Machmouchi Pharma kamph.co | Healthcare | Colombia | Aug 3, 2026 |
| United Fiber Optic Communication ufoc.com.tw | Manufacturing | Taiwan | Aug 3, 2026 |
| Western Union westernunion.gr | Financial Services | United States | Jul 30, 2026 |
| Ahenk Laboratuvarı ahenklab.com.tr | Healthcare | Turkey | Jul 29, 2026 |
| DIATER diater.com | Not identified | Spain | Jul 29, 2026 |
| Pasello Trattamenti Termici pasello.com | Manufacturing | Italy | Jul 29, 2026 |
| Takis Biotech takisbiotech.it | Not identified | Italy | Jul 29, 2026 |
| Hardware Asesorias Software hasltda.com | Technology | Colombia | Jul 28, 2026 |
| Tesco Engineers tesco-engineers.com | Construction | Thailand | Jul 28, 2026 |
| Caspian One caspianone.com | Financial Services | United Kingdom | Jul 27, 2026 |
| High Class highclasscarlimo.com | Healthcare | United States | Jul 27, 2026 |
| West African Resources westafricanresources.com | Not identified | Australia | Jul 27, 2026 |
| Aldaco Avance 2022 aldacogrupoavance.es | Construction | Spain | Jul 13, 2026 |
| BioResearch Group bioresearch.pl | Not identified | Poland | Jul 13, 2026 |
| Carrier Transport carrier.se | Energy | Sweden | Jul 13, 2026 |
| Enedo enedopower.com | Healthcare | Finland | Jul 13, 2026 |
| Grupo Relesa gruporelesa.com | Construction | Spain | Jul 13, 2026 |
| Hidromek hidromek.com | Construction | Turkey | Jul 13, 2026 |
Showing the 20 most recent of 112. Browse recent data breaches for more.
DeadLock leak sites
Addresses we've seen DeadLock publish victims from. Any .onion address needs the Tor Browser.
deadlock.liveblog365.comdeadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion
DeadLock questions
Is DeadLock still active?
Yes. DeadLock posted its most recent victim on August 12, 2026. That's 14 victims in the last 30 days.
How many victims has DeadLock claimed?
DeadLock has named 112 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did DeadLock first appear?
The first victim we recorded for DeadLock was posted on June 10, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does DeadLock target?
Manufacturing accounts for the most victims we can classify, with 30. Financial Services follows at 10. We could identify a sector for 87 of 112 victims, so treat this as the shape of the targeting rather than a full census.
Has DeadLock already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.