Hive

Dark since January 24, 2023
Also tracked as HiveLeaks
206 victims named on the leak site
0 in the last 30 days
0 in the last 12 months
Jun 2021 first victim we recorded
Jan 24, 2023 most recent victim posted
25 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

48.1% of Hive victims whose domain we can identify (99 of 206) had employee credentials leak in the 12 months before Hive named them as a victim.

We don't know whether any of these credentials were how Hive gained initial access.

What industries Hive targets

Sector identified for 45 of 206 victims.

Healthcare9
Manufacturing9
Education8
Construction4
Technology3
Energy2
Government2
Retail1

Where the victims are located

Country identified for 60 of 206 victims.

United Kingdom9
United States6
Brazil4
Switzerland3
Germany3
China3
France3
Peru2

Most recent Hive victims

VictimSectorCountryPosted
rcstevens.comConstructionNot identifiedJan 17, 2023
gwbcrane.comNot identifiedNot identifiedJan 12, 2023
consulatehc.comHealthcareNot identifiedJan 6, 2023
cmvcaridad.comHealthcareNot identifiedJan 2, 2023
mhmrabv.orgNon-profitNot identifiedDec 23, 2022
alvaria.comTechnologyNot identifiedDec 22, 2022
dixonsaa.comEducationNot identifiedDec 21, 2022
huntsvilletexas.comNot identifiedNot identifiedDec 21, 2022
huntsvilletx.govNot identifiedNot identifiedDec 21, 2022
ieminc.orgEducationNot identifiedDec 21, 2022
interface.comNot identifiedNot identifiedDec 21, 2022
nic.eduEducationNot identifiedDec 21, 2022
jakks.comManufacturingNot identifiedDec 20, 2022
stollemachinery.comNot identifiedNot identifiedDec 20, 2022
expandgroup.com.sgConstructionSingaporeDec 15, 2022
mark-taylor.comFinancial ServicesNot identifiedDec 15, 2022
intersport.frNot identifiedFranceDec 6, 2022
guilford.eduEducationNot identifiedNov 29, 2022
normanpublicschools.orgEducationNot identifiedNov 24, 2022
agri-fab.comNot identifiedNot identifiedNov 16, 2022

Showing the 20 most recent of 206. Browse recent data breaches for more.

Hive leak sites

Addresses we've seen Hive publish victims from. Any .onion address needs the Tor Browser.

  • hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion
  • ruu3yzgf4pd3qjoo7fs46lu3oqs6gggvvzk2oeu3jcelqe7sfvwevqyd.onion
  • u237r6z6axkagn6t2qiwx2rrvmq7pvz53tph7hl64geg3ee55gw66kad.onion
  • 7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion
  • ger6heo5mfiyrjoqwtd5rxdxsjgdo2fkxojpp4wj2w26zxuwyq2tvxqd.onion
  • zgsyd6ut6zavmewcik7qkgxn523iems5opnn3sk7j3wsbwhlgkskqqyd.onion
  • anonfiles.com
  • send.exploit.in
  • ak5quabcpv53mkinf5psw5orwmc3fdgxsbcnfz3nad7zvpn3a2qp6eqd.onion
  • jh4nf7dgbsf6jgmq5fxn4svfxhak6qq3mgrp3wcf7pqai4fakqdk7lad.onion
  • mega.nz
  • data-rte-br.com
  • iecix3lbo7y475yexogkijfp3srnavomvgsgzmsvjpbvux4gljoq3hqd.onion
  • temp.sh
  • an52fm2wt7w4z3r3v66lhmjhsytjwldznbi6nc4gdkrzwo5iouez45id.onion
  • qudxgtajj2y5ek7y4dpphwjv7rgdw2rcdtlwpajp7fgp3myqb6cjcjyd.onion
  • 2r7cbtnvuqr2o245bstbi4slfj3bjpiy5aemhp55xrmx4hpxe3rzsvad.onion
  • 2ppgpcyugpmcuxog2tnzdrxuig3g4x62qph54fplomgqfozhvuys6vid.onion
  • qhcri4qkatq55wyvwee34qh3osmwmiixptzbdw2ttnqbpxrs4ng5auyd.onion
  • gqhcu7d7oqhw4dm3suz3bwmejtrqawoxn3d62qab2mdzech6neoy4pad.onion
  • privatlab.com
  • i6kuam2x6fn5wjaajtwzxq43qk2rlntm6hywylby6ybad57aj27cghad.onion
  • k2pcq3l6nysqv4ez5vmww7ldbdqwjshk7kiw6mq4hdu6oqk7a2vxhpid.onion
  • uaec2sa6bpyo4h5bplni4hrcl5jwxmcvxqdjp42lullyddeijjughjyd.onion
  • u6i37st4dbo2b56etsfzkwscdr2os2gpsgkkpkcyf5qocz7yxes6nkyd.onion

Hive questions

Is Hive still active?

Not for over a year. The last victim we recorded was January 24, 2023. The leak site has published nothing since, though the data it already leaked is still out there.

How many victims has Hive claimed?

Hive has named 206 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did Hive first appear?

The first victim we recorded for Hive was posted on June 23, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Hive target?

Healthcare accounts for the most victims we can classify, with 9. Manufacturing follows at 9. We could identify a sector for 45 of 206 victims, so treat this as the shape of the targeting rather than a full census.

Has Hive already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.