Genesis

Active
101 victims named on the leak site
3 in the last 30 days
101 in the last 12 months
Oct 2025 first victim we recorded
Sep 15, 2026 most recent victim posted
1 leak site tracked

Data as of September 15, 2026.

Credential exposure before the attack

12.9% of Genesis victims whose domain we can identify (13 of 101) had employee credentials leak in the 12 months before Genesis named them as a victim.

We don't know whether any of these credentials were how Genesis gained initial access.

What industries Genesis targets

Sector identified for 81 of 101 victims.

Healthcare21
Legal12
Financial Services11
Manufacturing9
Construction9
Technology5
Government4
Real Estate2

Where the victims are located

Country identified for 97 of 101 victims.

United States85
United Kingdom4
India2
Canada2
United Arab Emirates1
Denmark1
Malaysia1
Italy1

Most recent Genesis victims

VictimSectorCountryPosted
Bernath & Rosenberg bernathandrosenberg.comFinancial ServicesUnited StatesSep 15, 2026
Dorfman Abrams Music dorfman.comFinancial ServicesUnited StatesSep 15, 2026
Hospitality Health ER hher24.comHealthcareUnited StatesAug 24, 2026
Interim HealthCare interimhealthcare.comHealthcareUnited StatesAug 11, 2026
Consolidated Medical Practices of Memphis medicalofmemphis.comHealthcareUnited StatesAug 11, 2026
Boyum IT Solutions (HOT!) boyum-it.comManufacturingDenmarkJul 31, 2026
C.A. Walker Construction cawalkerconstruction.comConstructionUnited StatesJul 31, 2026
Williams Accounting Professional bramptondirect.caFinancial ServicesCanadaJul 27, 2026
Infinity Pipeline infinitypipeinc.comConstructionUnited StatesJul 27, 2026
Building Envelope Systems teambes.comConstructionUnited StatesJul 27, 2026
Westlake Realty Group westlake-realty.comFinancial ServicesUnited StatesJul 27, 2026
Apex Agro apexagchem.comLogisticsUnited StatesJul 6, 2026
Bri-Tech bri-tech.comNot identifiedUnited StatesJul 6, 2026
Dicon Construction dicon.comHealthcareUnited StatesJul 6, 2026
Dunagan Associates dunaganassociates.comFinancial ServicesUnited StatesJul 6, 2026
East Texas Family Medicine etfmed.comHealthcareUnited StatesJul 6, 2026
Mirage Endoscopy Center mirageendoscopycenter.comNot identifiedUnited StatesJul 6, 2026
SBI Software sbigrower.comTechnologyUnited StatesJul 6, 2026
Synergy Interactive sinyc.comNot identifiedUnited StatesJul 6, 2026
Westgate westgatellc.comConstructionUnited StatesJul 6, 2026

Showing the 20 most recent of 101. Browse recent data breaches for more.

Genesis leak site

The address we've seen Genesis publish victims from. Any .onion address needs the Tor Browser.

  • genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion

Genesis questions

Is Genesis still active?

Yes. Genesis posted its most recent victim on September 15, 2026. That's 3 victims in the last 30 days.

How many victims has Genesis claimed?

Genesis has named 101 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did Genesis first appear?

The first victim we recorded for Genesis was posted on October 22, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Genesis target?

Healthcare accounts for the most victims we can classify, with 21. Legal follows at 12. We could identify a sector for 81 of 101 victims, so treat this as the shape of the targeting rather than a full census.

Has Genesis already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.