HiveLeaks

Dark since January 24, 2023

130 victims named on the leak site

0 in the last 30 days

0 in the last 12 months

Sep 2021 first victim we recorded

Jan 24, 2023 most recent victim posted

25 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

29.2% of HiveLeaks victims whose domain we can identify (38 of 130) had employee credentials leak in the 12 months before HiveLeaks named them as a victim.

We don't know whether any of these credentials were how HiveLeaks gained initial access.

What industries HiveLeaks targets

Sector identified for 43 of 130 victims.

Healthcare	9
Manufacturing	9
Education	8
Technology	3
Construction	3
Government	2
Retail	1
Legal	1

Where the victims are located

Country identified for 38 of 130 victims.

United Kingdom	7
United States	5
Brazil	3
France	2
China	2
Malaysia	2
Germany	2
Peru	1

Most recent HiveLeaks victims

Victim	Sector	Country	Posted
rcstevens.com	Construction	Not identified	Jan 17, 2023
gwbcrane.com	Not identified	Not identified	Jan 12, 2023
consulatehc.com	Healthcare	Not identified	Jan 6, 2023
cmvcaridad.com	Healthcare	Not identified	Jan 2, 2023
mhmrabv.org	Non-profit	Not identified	Dec 23, 2022
alvaria.com	Technology	Not identified	Dec 22, 2022
dixonsaa.com	Education	Not identified	Dec 21, 2022
huntsvilletexas.com	Not identified	Not identified	Dec 21, 2022
huntsvilletx.gov	Not identified	Not identified	Dec 21, 2022
ieminc.org	Education	Not identified	Dec 21, 2022
interface.com	Not identified	Not identified	Dec 21, 2022
nic.edu	Education	Not identified	Dec 21, 2022
jakks.com	Manufacturing	Not identified	Dec 20, 2022
stollemachinery.com	Not identified	Not identified	Dec 20, 2022
expandgroup.com.sg	Construction	Singapore	Dec 15, 2022
mark-taylor.com	Financial Services	Not identified	Dec 15, 2022
intersport.fr	Not identified	France	Dec 6, 2022
guilford.edu	Education	Not identified	Nov 29, 2022
normanpublicschools.org	Education	Not identified	Nov 24, 2022
agri-fab.com	Not identified	Not identified	Nov 16, 2022

Showing the 20 most recent of 130. Browse recent data breaches for more.

HiveLeaks leak sites

Addresses we've seen HiveLeaks publish victims from. Any .onion address needs the Tor Browser.

hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion
ruu3yzgf4pd3qjoo7fs46lu3oqs6gggvvzk2oeu3jcelqe7sfvwevqyd.onion
u237r6z6axkagn6t2qiwx2rrvmq7pvz53tph7hl64geg3ee55gw66kad.onion
7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion
ger6heo5mfiyrjoqwtd5rxdxsjgdo2fkxojpp4wj2w26zxuwyq2tvxqd.onion
zgsyd6ut6zavmewcik7qkgxn523iems5opnn3sk7j3wsbwhlgkskqqyd.onion
anonfiles.com
ak5quabcpv53mkinf5psw5orwmc3fdgxsbcnfz3nad7zvpn3a2qp6eqd.onion
jh4nf7dgbsf6jgmq5fxn4svfxhak6qq3mgrp3wcf7pqai4fakqdk7lad.onion
temp.sh
an52fm2wt7w4z3r3v66lhmjhsytjwldznbi6nc4gdkrzwo5iouez45id.onion
qudxgtajj2y5ek7y4dpphwjv7rgdw2rcdtlwpajp7fgp3myqb6cjcjyd.onion
2ppgpcyugpmcuxog2tnzdrxuig3g4x62qph54fplomgqfozhvuys6vid.onion
qhcri4qkatq55wyvwee34qh3osmwmiixptzbdw2ttnqbpxrs4ng5auyd.onion
gqhcu7d7oqhw4dm3suz3bwmejtrqawoxn3d62qab2mdzech6neoy4pad.onion
i6kuam2x6fn5wjaajtwzxq43qk2rlntm6hywylby6ybad57aj27cghad.onion
k2pcq3l6nysqv4ez5vmww7ldbdqwjshk7kiw6mq4hdu6oqk7a2vxhpid.onion
uaec2sa6bpyo4h5bplni4hrcl5jwxmcvxqdjp42lullyddeijjughjyd.onion
u6i37st4dbo2b56etsfzkwscdr2os2gpsgkkpkcyf5qocz7yxes6nkyd.onion
l6ctoigdfjvrnlaxm7af6urwtsryrc6m4ll5yeezyjcirra7gpojq7ad.onion
2r7cbtnvuqr2o245bstbi4slfj3bjpiy5aemhp55xrmx4hpxe3rzsvad.onion
m52j7ur2ux5qof6cmljylivjx5c2vjxtlg4vspxl6g2qbxt3k6cqwcad.onion
yiitb2tkh2oij5u5tfwzrftofjsvl3gpdc65vcwumiclznqzxeo742yd.onion
eluzlcckkhuvfsc6nhio2uz2bjj2zex67a3mw7cc3vifai37uprxsgqd.onion
sj7cw332z2ndz7cfpsrsldi4nlfbhbn63wvitdundmmuiixkhhwf4oad.onion

HiveLeaks questions

Is HiveLeaks still active?

Not for over a year. The last victim we recorded was January 24, 2023. The leak site has published nothing since, though the data it already leaked is still out there.

How many victims has HiveLeaks claimed?

HiveLeaks has named 130 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did HiveLeaks first appear?

The first victim we recorded for HiveLeaks was posted on September 15, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does HiveLeaks target?

Healthcare accounts for the most victims we can classify, with 9. Manufacturing follows at 9. We could identify a sector for 43 of 130 victims, so treat this as the shape of the targeting rather than a full census.

Has HiveLeaks already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.