Embargo

Active
45 victims named on the leak site
1 in the last 30 days
15 in the last 12 months
Apr 2024 first victim we recorded
Sep 10, 2026 most recent victim posted
25 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

46.7% of Embargo victims whose domain we can identify (21 of 45) had employee credentials leak in the 12 months before Embargo named them as a victim.

We don't know whether any of these credentials were how Embargo gained initial access.

What industries Embargo targets

Sector identified for 30 of 45 victims.

Manufacturing6
Healthcare5
Construction4
Logistics4
Technology3
Retail3
Hospitality2
Financial Services2

Where the victims are located

Country identified for 20 of 45 victims.

United States9
United Kingdom2
Germany2
Turkey1
Australia1
India1
Hungary1
Canada1

Most recent Embargo victims

VictimSectorCountryPosted
Gardens Alive gardensalive.comRetailUnited StatesSep 10, 2026
May Trucking maytrucking.comLogisticsUnited StatesJul 1, 2026
Auburn Electrical Construction aecci.comConstructionUnited StatesJun 10, 2026
ChipSoft chipsoft.comHealthcareNetherlandsApr 23, 2026
CipSoft cipsoft.comNot identifiedGermanyApr 21, 2026
Lagoon Park lagoonpark.comHospitalityUnited StatesApr 1, 2026
Ludlums ludlums.comRetailUnited KingdomMar 27, 2026
Westport Fuel Systems westport.comManufacturingCanadaMar 16, 2026
Seclore seclore.comTechnologyIndiaMar 12, 2026
UBM Group ubm.huAgricultureHungaryMar 12, 2026
NCH nch.comManufacturingUnited StatesMar 10, 2026
LSO lso.comLogisticsUnited StatesDec 8, 2025
ACTi acti.comNot identifiedNot identifiedOct 23, 2025
USA DeBusk usadebusk.comManufacturingUnited StatesSep 22, 2025
Heart of America Medical Center hamc.comHealthcareUnited StatesAug 7, 2025
Hawaii Unified hawaiiunified.comConstructionNot identifiedJul 9, 2025
Rotary rotaryeng.com.sgHealthcareSingaporeJul 9, 2025
Hawai\'i Unified hawaiiunified.comConstructionNot identifiedJun 25, 2025
M&H Electric Fabricators wiringharness.comNot identifiedNot identifiedMay 30, 2025
All Star Flooring allstarflooring.comNot identifiedNot identifiedMay 26, 2025

Showing the 20 most recent of 45. Browse recent data breaches for more.

Embargo leak sites

Addresses we've seen Embargo publish victims from. Any .onion address needs the Tor Browser.

  • embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion
  • 4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad.onion
  • vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd.onion
  • ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd.onion
  • p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad.onion
  • qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd.onion
  • z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd.onion
  • 7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad.onion
  • 7watkqnnuwxvlpgy5gaosgqy67nve3jgpy37xobqngmswz3vuvde56yd.onion
  • usu2gxoiijvnswhfymd6ucjjwhtgqby4c4ywzvnrtw4i6mpgppvzpsad.onion
  • qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd.onion
  • 3o5ewrzhqoyodfs5kll4cjxagdfrpuu474panwobm4im7ejfpaux5jyd.onion
  • sbjthwyoxfuxq75b77e2hsj7ie67m3qicfnuikhuabwo3sikvrzyaxad.onion
  • zo5xog4vpvdae473doneepetidh36m5czdq2vyeiq3lvqhuel56p6nid.onion
  • ufjoe7fdwvml52oin7flwlqksvp3fcvfyh2kwsngt7j2yf7xou52w2qd.onion
  • 6sf5xa7eso3e3vk46i5tpcqhnlayczztj7zjktzaztlotyy75zs6j7qd.onion
  • i2okedfryhllg6ka6aur3wnxcxdaufbuuysp4drr5xoc6gvqpcogejid.onion
  • oftm4u5cfl6wyadj27h3csdxfvyd7favssxcr7l7wnswdsrfedxswxqd.onion
  • s37weqmxusvfcxkoorgkut5v7frn27zftdb6pdjsyjl5djg6oxjqjbid.onion
  • wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd.onion
  • 76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd.onion
  • yj3eozlkkxkcsprc2fug7tolgtnllruyavuyyar3yzsccjdgvu2bl2yd.onion
  • 66ohzao6afsv2opk22r2kv6fbnf2fthe7v4ykzzc5vjezvvyf3gocwyd.onion
  • 2nn4b6gihz5bttzabjegune3blwktad2zmy77fwutvvrxxodbufo6qid.onion
  • kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion

Embargo questions

Is Embargo still active?

Yes. Embargo posted its most recent victim on September 10, 2026.

How many victims has Embargo claimed?

Embargo has named 45 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 15 of them were posted in the last 12 months.

When did Embargo first appear?

The first victim we recorded for Embargo was posted on April 22, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Embargo target?

Manufacturing accounts for the most victims we can classify, with 6. Healthcare follows at 5. We could identify a sector for 30 of 45 victims, so treat this as the shape of the targeting rather than a full census.

Has Embargo already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.