Global
Data as of September 14, 2026.
Credential exposure before the attack
17.1% of Global victims whose domain we can identify (6 of 35) had employee credentials leak in the 12 months before Global named them as a victim.
We don't know whether any of these credentials were how Global gained initial access.
What industries Global targets
Sector identified for 18 of 35 victims.
| Healthcare | 8 | |
| Manufacturing | 5 | |
| Financial Services | 1 | |
| Media | 1 | |
| Construction | 1 | |
| Government | 1 | |
| Education | 1 |
Where the victims are located
Country identified for 26 of 35 victims.
| United States | 5 | |
| Australia | 3 | |
| United Kingdom | 3 | |
| Brazil | 2 | |
| Italy | 2 | |
| Spain | 2 | |
| China | 2 | |
| Turkey | 1 |
Most recent Global victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Town of Sutton, Massachusetts suttonma.gov | Government | United States | Sep 14, 2026 |
| Sutton Public Schools suttonschools.net | Education | United States | Sep 14, 2026 |
| ATCOM Technology atcomm.cn | Manufacturing | China | Aug 31, 2026 |
| Qihan Biotech qihanbio.com | Not identified | China | Aug 31, 2026 |
| Shanghai Tunnel Engineering stecs.com.sg | Construction | Singapore | Aug 31, 2026 |
| Vigiila vigilia.com.uy | Healthcare | Not identified | Aug 31, 2026 |
| Adventist Health White Memorial Medical Village awmedicalvillage.org | Healthcare | United States | Aug 21, 2025 |
| Hospital e Maternidade São José hmsaojose.com | Healthcare | Brazil | Aug 21, 2025 |
| RUKU Tore – Türen ruku.info | Not identified | Not identified | Jul 31, 2025 |
| Albavisión albavision.tv | Not identified | Spain | Jul 29, 2025 |
| Cyma cymasalud.com | Not identified | Mexico | Jul 28, 2025 |
| Dithelm Travel Group dth.travel | Not identified | Not identified | Jul 28, 2025 |
| Geomaticks Grecia geomatics.gr | Not identified | Greece | Jul 28, 2025 |
| La Favorita Italia lafavoritaservice.it | Not identified | Italy | Jul 28, 2025 |
| Medical Village LIV livmedicalspa.com | Healthcare | Not identified | Jul 28, 2025 |
| Moelco Técnicas Aplicadas moelco.es | Manufacturing | Spain | Jul 28, 2025 |
| Rete Toscana Classica retetoscanaclassica.it | Media | Italy | Jul 28, 2025 |
| Lorain County Auditor loraincountyauditor.gov | Not identified | United States | Jul 15, 2025 |
| Emphail emphail.com | Healthcare | Not identified | Jul 10, 2025 |
| ENT Energiteknik entab.se | Not identified | Sweden | Jul 1, 2025 |
Showing the 20 most recent of 35. Browse recent data breaches for more.
Global leak sites
Addresses we've seen Global publish victims from. Any .onion address needs the Tor Browser.
vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion7bmz2tc4p2jk23dcyehg37cd7veflk3fyhxrnbxz75vvno2azfy6qayd.onion4zrjdyuq4sjogm2epwwoleegquavhwo3o7fakstnlgox6guqt3qpe4qd.onion
Global questions
Is Global still active?
Yes. Global posted its most recent victim on September 14, 2026. That's 6 victims in the last 30 days.
How many victims has Global claimed?
Global has named 35 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 6 of them were posted in the last 12 months.
When did Global first appear?
The first victim we recorded for Global was posted on June 4, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Global target?
Healthcare accounts for the most victims we can classify, with 8. Manufacturing follows at 5. We could identify a sector for 18 of 35 victims, so treat this as the shape of the targeting rather than a full census.
Has Global already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.