Hunters
Data as of August 16, 2026.
Credential exposure before the attack
48.8% of Hunters victims whose domain we can identify (142 of 291) had employee credentials leak in the 12 months before Hunters named them as a victim.
We don't know whether any of these credentials were how Hunters gained initial access.
What industries Hunters targets
Sector identified for 170 of 291 victims.
| Manufacturing | 44 | |
| Healthcare | 22 | |
| Construction | 19 | |
| Financial Services | 19 | |
| Energy | 11 | |
| Logistics | 10 | |
| Legal | 9 | |
| Government | 8 |
Where the victims are located
Country identified for 75 of 291 victims.
| United Kingdom | 10 | |
| Canada | 6 | |
| France | 5 | |
| Spain | 4 | |
| Germany | 4 | |
| Australia | 4 | |
| Brazil | 4 | |
| Japan | 3 |
Most recent Hunters victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Corantioquia corantioquia.gov.co | Not identified | Colombia | May 28, 2025 |
| Eight8Ate eight8ate.ph | Not identified | Philippines | May 28, 2025 |
| Wrap & Send wrapandsend.com | Logistics | Not identified | May 28, 2025 |
| GPF Lewis gpflewis.co.uk | Healthcare | United Kingdom | May 6, 2025 |
| Sioux Chief siouxchief.com | Government | Not identified | May 6, 2025 |
| Digestive Specialists digestivespecialists.com | Not identified | Not identified | May 2, 2025 |
| Forum Communications forumcomm.com | Not identified | Not identified | May 2, 2025 |
| Telco Intercontinental telcointercon.com | Not identified | Not identified | May 2, 2025 |
| KTradeCPJgTxDPXrsuuSE2LCkgBN8Rpsa5PC8p kasb.com | Not identified | Not identified | Apr 28, 2025 |
| Kenworth Del Sur kenworthdelsur.com.mx | Financial Services | Mexico | Apr 28, 2025 |
| Minnesota Lawyers Mutual Insurance mlmins.com | Financial Services | Not identified | Apr 28, 2025 |
| mafi NATURHOLZBODEN mafi.com | Not identified | Not identified | Apr 23, 2025 |
| Pharma Force pharmaforce.be | Healthcare | Belgium | Apr 22, 2025 |
| HOPI hopi.cz | Logistics | Czech Republic | Apr 18, 2025 |
| Blackmon Mooring bmscat.com | Not identified | Not identified | Apr 7, 2025 |
| Groupe Delcourt groupedelcourt.com | Not identified | Not identified | Apr 7, 2025 |
| Hofmann Fördertechnik hofmann-foerdertechnik.com | Not identified | Not identified | Apr 7, 2025 |
| IDS Infotech idsil.com | Healthcare | Not identified | Apr 7, 2025 |
| National Sign nationalsign.net | Manufacturing | Not identified | Apr 7, 2025 |
| Nexia Poyiadjis nexia.com.cy | Financial Services | Not identified | Apr 7, 2025 |
Showing the 20 most recent of 291. Browse recent data breaches for more.
Hunters leak sites
Addresses we've seen Hunters publish victims from. Any .onion address needs the Tor Browser.
hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onionransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onionhunters55wwmd25ycahnbn5xh45hvtwbmby6ly4p6qee5pughbyrajqd.onionxb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onionalphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion
Hunters questions
Is Hunters still active?
Not for over a year. The last victim we recorded was May 28, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Hunters claimed?
Hunters has named 291 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Hunters first appear?
The first victim we recorded for Hunters was posted on January 4, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Hunters target?
Manufacturing accounts for the most victims we can classify, with 44. Healthcare follows at 22. We could identify a sector for 170 of 291 victims, so treat this as the shape of the targeting rather than a full census.
Has Hunters already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.