GlobalSecretGroup

Active
40 victims named on the leak site
10 in the last 30 days
40 in the last 12 months
Jul 2026 first victim we recorded
Sep 11, 2026 most recent victim posted
1 leak site tracked

Data as of September 15, 2026.

Credential exposure before the attack

22.5% of GlobalSecretGroup victims whose domain we can identify (9 of 40) had employee credentials leak in the 12 months before GlobalSecretGroup named them as a victim.

We don't know whether any of these credentials were how GlobalSecretGroup gained initial access.

What industries GlobalSecretGroup targets

Sector identified for 35 of 40 victims.

Healthcare6
Financial Services6
Manufacturing6
Construction4
Logistics3
Education2
Automotive2
Energy2

Where the victims are located

Country identified for 37 of 40 victims.

United States25
India3
Brazil2
Canada2
Greece1
Spain1
Argentina1
United Kingdom1

Most recent GlobalSecretGroup victims

VictimSectorCountryPosted
India LEI indialei.inNot identifiedIndiaSep 11, 2026
Mesan USA mesanusa.comManufacturingUnited StatesSep 10, 2026
Quality Resource qualityresourcepvt.comTechnologyNot identifiedSep 2, 2026
R L Fine Chem rlfinechem.comHealthcareIndiaSep 1, 2026
Johnson City Honda johnsoncityhonda.comAutomotiveUnited StatesAug 26, 2026
Lockheed Architectural Solutions lockheedsolutions.comConstructionUnited StatesAug 26, 2026
Tiseo Paving tiseopaving.comConstructionUnited StatesAug 26, 2026
4M Realty 4mrealty.comReal EstateUnited StatesAug 19, 2026
The Rubber Group rubber-group.comManufacturingUnited StatesAug 19, 2026
Columbia University columbia.eduEducationUnited StatesAug 17, 2026
Coggins Insurance Agency cogginsinsurance.comFinancial ServicesUnited StatesAug 11, 2026
Cook Remodeling & Custom Construction cookremodeling.comConstructionUnited StatesAug 11, 2026
MACOFIN HELLAS maco-fin.comFinancial ServicesGreeceAug 11, 2026
Pavillon pavillon.orgHealthcareUnited StatesAug 7, 2026
Pro-Tuff Decals protuffdecals.comNot identifiedUnited StatesAug 7, 2026
Vernon & Waldrep OB-Gyn Associates vernonwaldrep.comHealthcareUnited StatesAug 3, 2026
Hinduja Tech hindujatech.comAutomotiveIndiaJul 28, 2026
Louisiana Coalition Against Domestic Violence lcadv.orgEducationUnited StatesJul 28, 2026
Park Manufacturing parkmfg.comManufacturingUnited StatesJul 28, 2026
Spergel spergel.caNot identifiedCanadaJul 28, 2026

Showing the 20 most recent of 40. Browse recent data breaches for more.

GlobalSecretGroup leak site

The address we've seen GlobalSecretGroup publish victims from. Any .onion address needs the Tor Browser.

  • o5lsqyar7ox25z734k6zaxt2vf7bsyi4q5rturi5iyxzqo3ica7bjsad.onion

GlobalSecretGroup questions

Is GlobalSecretGroup still active?

Yes. GlobalSecretGroup posted its most recent victim on September 11, 2026. That's 10 victims in the last 30 days.

How many victims has GlobalSecretGroup claimed?

GlobalSecretGroup has named 40 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did GlobalSecretGroup first appear?

The first victim we recorded for GlobalSecretGroup was posted on July 27, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does GlobalSecretGroup target?

Healthcare accounts for the most victims we can classify, with 6. Financial Services follows at 6. We could identify a sector for 35 of 40 victims, so treat this as the shape of the targeting rather than a full census.

Has GlobalSecretGroup already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.