
Genesis
Data as of September 15, 2026.
Credential exposure before the attack
12.9% of Genesis victims whose domain we can identify (13 of 101) had employee credentials leak in the 12 months before Genesis named them as a victim.
We don't know whether any of these credentials were how Genesis gained initial access.
What industries Genesis targets
Sector identified for 81 of 101 victims.
| Healthcare | 21 | |
| Legal | 12 | |
| Financial Services | 11 | |
| Manufacturing | 9 | |
| Construction | 9 | |
| Technology | 5 | |
| Government | 4 | |
| Real Estate | 2 |
Where the victims are located
Country identified for 97 of 101 victims.
| United States | 85 | |
| United Kingdom | 4 | |
| India | 2 | |
| Canada | 2 | |
| United Arab Emirates | 1 | |
| Denmark | 1 | |
| Malaysia | 1 | |
| Italy | 1 |
Most recent Genesis victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Bernath & Rosenberg bernathandrosenberg.com | Financial Services | United States | Sep 15, 2026 |
| Dorfman Abrams Music dorfman.com | Financial Services | United States | Sep 15, 2026 |
| Hospitality Health ER hher24.com | Healthcare | United States | Aug 24, 2026 |
| Interim HealthCare interimhealthcare.com | Healthcare | United States | Aug 11, 2026 |
| Consolidated Medical Practices of Memphis medicalofmemphis.com | Healthcare | United States | Aug 11, 2026 |
| Boyum IT Solutions (HOT!) boyum-it.com | Manufacturing | Denmark | Jul 31, 2026 |
| C.A. Walker Construction cawalkerconstruction.com | Construction | United States | Jul 31, 2026 |
| Williams Accounting Professional bramptondirect.ca | Financial Services | Canada | Jul 27, 2026 |
| Infinity Pipeline infinitypipeinc.com | Construction | United States | Jul 27, 2026 |
| Building Envelope Systems teambes.com | Construction | United States | Jul 27, 2026 |
| Westlake Realty Group westlake-realty.com | Financial Services | United States | Jul 27, 2026 |
| Apex Agro apexagchem.com | Logistics | United States | Jul 6, 2026 |
| Bri-Tech bri-tech.com | Not identified | United States | Jul 6, 2026 |
| Dicon Construction dicon.com | Healthcare | United States | Jul 6, 2026 |
| Dunagan Associates dunaganassociates.com | Financial Services | United States | Jul 6, 2026 |
| East Texas Family Medicine etfmed.com | Healthcare | United States | Jul 6, 2026 |
| Mirage Endoscopy Center mirageendoscopycenter.com | Not identified | United States | Jul 6, 2026 |
| SBI Software sbigrower.com | Technology | United States | Jul 6, 2026 |
| Synergy Interactive sinyc.com | Not identified | United States | Jul 6, 2026 |
| Westgate westgatellc.com | Construction | United States | Jul 6, 2026 |
Showing the 20 most recent of 101. Browse recent data breaches for more.
Genesis leak site
The address we've seen Genesis publish victims from. Any .onion address needs the Tor Browser.
genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion
Genesis questions
Is Genesis still active?
Yes. Genesis posted its most recent victim on September 15, 2026. That's 3 victims in the last 30 days.
How many victims has Genesis claimed?
Genesis has named 101 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Genesis first appear?
The first victim we recorded for Genesis was posted on October 22, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Genesis target?
Healthcare accounts for the most victims we can classify, with 21. Legal follows at 12. We could identify a sector for 81 of 101 victims, so treat this as the shape of the targeting rather than a full census.
Has Genesis already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.