Fog
Data as of August 16, 2026.
Credential exposure before the attack
63.8% of Fog victims whose domain we can identify (113 of 177) had employee credentials leak in the 12 months before Fog named them as a victim.
We don't know whether any of these credentials were how Fog gained initial access.
What industries Fog targets
Sector identified for 109 of 177 victims.
| Education | 33 | |
| Technology | 19 | |
| Manufacturing | 19 | |
| Financial Services | 7 | |
| Logistics | 5 | |
| Healthcare | 5 | |
| Telecommunications | 3 | |
| Government | 3 |
Where the victims are located
Country identified for 56 of 177 victims.
| Germany | 11 | |
| Australia | 5 | |
| United States | 5 | |
| Indonesia | 3 | |
| Netherlands | 3 | |
| Sweden | 3 | |
| Italy | 3 | |
| Brazil | 3 |
Most recent Fog victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Newtown Friends School newtownfriends.org | Education | Not identified | Mar 21, 2025 |
| Real Academia Española rae.es | Not identified | Spain | Mar 18, 2025 |
| El Camino Real Academy elcaminorealacademy.com | Education | Not identified | Mar 13, 2025 |
| University Diagnostic Medical Imaging udmi.net | Healthcare | Not identified | Mar 13, 2025 |
| Magnolia Manor magnoliamanor.com | Non-profit | Not identified | Mar 11, 2025 |
| Wilkinson Rogers wilkinsonrogers.com | Financial Services | Canada | Mar 11, 2025 |
| Oberlin oberlin.net | Not identified | Not identified | Mar 7, 2025 |
| WJCC Public Schools wjccschools.org | Education | Not identified | Mar 7, 2025 |
| 1xinternet.de 1xinternet.de | Not identified | Germany | Mar 6, 2025 |
| AeonSparx aeonsparx.com | Not identified | Not identified | Mar 6, 2025 |
| BizCoDe bizcode.it | Technology | Italy | Mar 6, 2025 |
| Blue Planet blueplanet.com | Not identified | Not identified | Mar 6, 2025 |
| CIE Group cie-group.cz | Healthcare | Czech Republic | Mar 6, 2025 |
| Engicam S.r.l. engicam.com | Manufacturing | Not identified | Mar 6, 2025 |
| EUMETSAT eumetsat.int | Not identified | Not identified | Mar 6, 2025 |
| Euranova euranova.eu | Technology | Not identified | Mar 6, 2025 |
| FHNW fhnw.ch | Education | Switzerland | Mar 6, 2025 |
| FlightSim Studio flightsim-studio.com | Technology | Not identified | Mar 6, 2025 |
| Inelmatic inelmatic.com | Healthcare | Not identified | Mar 6, 2025 |
| Internet Thailand Public inet.co.th | Not identified | Thailand | Mar 6, 2025 |
Showing the 20 most recent of 177. Browse recent data breaches for more.
Fog leak sites
Addresses we've seen Fog publish victims from. Any .onion address needs the Tor Browser.
xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onionbashex7mokreyoxl6wlswxl4foi7okgs7or7aergnuiockuoq35yt3ad.onion
Fog questions
Is Fog still active?
Not for over a year. The last victim we recorded was March 26, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Fog claimed?
Fog has named 177 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Fog first appear?
The first victim we recorded for Fog was posted on July 17, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Fog target?
Education accounts for the most victims we can classify, with 33. Technology follows at 19. We could identify a sector for 109 of 177 victims, so treat this as the shape of the targeting rather than a full census.
Has Fog already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.