
GlobalSecretGroup
Data as of August 16, 2026.
Credential exposure before the attack
23.3% of GlobalSecretGroup victims whose domain we can identify (7 of 30) had employee credentials leak in the 12 months before GlobalSecretGroup named them as a victim.
We don't know whether any of these credentials were how GlobalSecretGroup gained initial access.
What industries GlobalSecretGroup targets
Sector identified for 26 of 30 victims.
| Financial Services | 6 | |
| Healthcare | 5 | |
| Manufacturing | 4 | |
| Logistics | 3 | |
| Construction | 2 | |
| Energy | 2 | |
| Legal | 1 | |
| Retail | 1 |
Where the victims are located
Country identified for 28 of 30 victims.
| United States | 18 | |
| Brazil | 2 | |
| Canada | 2 | |
| Spain | 1 | |
| Argentina | 1 | |
| United Kingdom | 1 | |
| China | 1 | |
| India | 1 |
Most recent GlobalSecretGroup victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Coggins Insurance Agency cogginsinsurance.com | Financial Services | United States | Aug 11, 2026 |
| Cook Remodeling & Custom Construction cookremodeling.com | Construction | United States | Aug 11, 2026 |
| MACOFIN HELLAS maco-fin.com | Financial Services | Greece | Aug 11, 2026 |
| Pavillon pavillon.org | Healthcare | United States | Aug 7, 2026 |
| Pro-Tuff Decals protuffdecals.com | Not identified | United States | Aug 7, 2026 |
| Vernon & Waldrep OB-Gyn Associates vernonwaldrep.com | Healthcare | United States | Aug 3, 2026 |
| Hinduja Tech hindujatech.com | Automotive | India | Jul 28, 2026 |
| Louisiana Coalition Against Domestic Violence lcadv.org | Education | United States | Jul 28, 2026 |
| Park Manufacturing parkmfg.com | Manufacturing | United States | Jul 28, 2026 |
| Spergel spergel.ca | Not identified | Canada | Jul 28, 2026 |
| Acens acens.com | Not identified | Spain | Jul 27, 2026 |
| West Sixth Law agslawyers.com | Legal | United States | Jul 27, 2026 |
| Al Hayat alhayatco.com | Manufacturing | Not identified | Jul 27, 2026 |
| Baker Business & Tax Solutions bakerbusinessandtax.com | Financial Services | United States | Jul 27, 2026 |
| Carpets Direct carpetsdirectfindlay.com | Retail | United States | Jul 27, 2026 |
| Chappell Supply and Equipment chappellsupply.com | Manufacturing | United States | Jul 27, 2026 |
| Cold Front Distribution coldfrontdist.com | Logistics | United States | Jul 27, 2026 |
| Farmers of Marble farmersofmarble.com | Financial Services | United States | Jul 27, 2026 |
| Transportes La Sevillanita lasevillanita.com | Logistics | Argentina | Jul 27, 2026 |
| Middendorf Animal Hospital & Laser Centre middendorfanimalhospital.com | Healthcare | United States | Jul 27, 2026 |
Showing the 20 most recent of 30. Browse recent data breaches for more.
GlobalSecretGroup leak site
The address we've seen GlobalSecretGroup publish victims from. Any .onion address needs the Tor Browser.
o5lsqyar7ox25z734k6zaxt2vf7bsyi4q5rturi5iyxzqo3ica7bjsad.onion
GlobalSecretGroup questions
Is GlobalSecretGroup still active?
Yes. GlobalSecretGroup posted its most recent victim on August 11, 2026. That's 30 victims in the last 30 days.
How many victims has GlobalSecretGroup claimed?
GlobalSecretGroup has named 30 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did GlobalSecretGroup first appear?
The first victim we recorded for GlobalSecretGroup was posted on July 27, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does GlobalSecretGroup target?
Financial Services accounts for the most victims we can classify, with 6. Healthcare follows at 5. We could identify a sector for 26 of 30 victims, so treat this as the shape of the targeting rather than a full census.
Has GlobalSecretGroup already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.