ElDorado
Data as of August 16, 2026.
Credential exposure before the attack
52.6% of ElDorado victims whose domain we can identify (20 of 38) had employee credentials leak in the 12 months before ElDorado named them as a victim.
We don't know whether any of these credentials were how ElDorado gained initial access.
What industries ElDorado targets
Sector identified for 18 of 38 victims.
| Construction | 5 | |
| Manufacturing | 4 | |
| Logistics | 2 | |
| Automotive | 1 | |
| Financial Services | 1 | |
| Technology | 1 | |
| Real Estate | 1 | |
| Government | 1 |
Where the victims are located
Country identified for 7 of 38 victims.
| Italy | 2 | |
| Japan | 1 | |
| Canada | 1 | |
| Brazil | 1 | |
| United States | 1 | |
| Croatia | 1 |
Most recent ElDorado victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Lumenation lumenation.net | Not identified | Not identified | Jun 4, 2025 |
| Navesink Rehab navesinkrehab.com | Not identified | Not identified | Jun 4, 2025 |
| Solar City solarcity.org | Not identified | Not identified | Jun 4, 2025 |
| Riverdell Construction riverdellconstruction.com | Construction | Not identified | Jun 3, 2025 |
| MCM Construction mcmconstructioninc.com | Not identified | Not identified | Jun 2, 2025 |
| Lac La Biche Transport laclabichetransport.ca | Logistics | Canada | May 28, 2025 |
| Reliance Heating and Air Conditioning reliance-hvac.com | Not identified | Not identified | May 26, 2025 |
| Toho toho.co.jp | Not identified | Japan | May 19, 2025 |
| Compra Aruba compra-aruba.com | Not identified | Not identified | Oct 15, 2024 |
| CMC cmclb.com | Not identified | Not identified | Sep 24, 2024 |
| Cucina Tagliani cucinatagliani.com | Not identified | Not identified | Sep 24, 2024 |
| Data Campos Sistemas datacampos.com | Manufacturing | Brazil | Sep 24, 2024 |
| Kennedy Funding kennedyfunding.com | Not identified | Not identified | Sep 16, 2024 |
| Palm Facility Services palmfs.com | Construction | Not identified | Sep 16, 2024 |
| A-1 Mobile Lock & Key a1mobilelock.com | Not identified | Not identified | Sep 14, 2024 |
| Patrick Sanders patricksanderscompany.com | Financial Services | Not identified | Sep 14, 2024 |
| Pacific Educational Services pesprograms.com | Not identified | Not identified | Sep 14, 2024 |
| Seagle Safety seaglesafety.com | Manufacturing | Not identified | Sep 14, 2024 |
| Think Simple thinksimple.com | Not identified | Not identified | Sep 14, 2024 |
| New River Electrical newriverelectrical.com | Construction | Not identified | Sep 2, 2024 |
Showing the 20 most recent of 38. Browse recent data breaches for more.
ElDorado leak sites
Addresses we've seen ElDorado publish victims from. Any .onion address needs the Tor Browser.
dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onionzdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onionwww.sendgb.com
ElDorado questions
Is ElDorado still active?
Not for over a year. The last victim we recorded was June 4, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has ElDorado claimed?
ElDorado has named 38 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did ElDorado first appear?
The first victim we recorded for ElDorado was posted on June 7, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does ElDorado target?
Construction accounts for the most victims we can classify, with 5. Manufacturing follows at 4. We could identify a sector for 18 of 38 victims, so treat this as the shape of the targeting rather than a full census.
Has ElDorado already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.