INSOMNIA
Data as of September 14, 2026.
Credential exposure before the attack
9.8% of INSOMNIA victims whose domain we can identify (5 of 51) had employee credentials leak in the 12 months before INSOMNIA named them as a victim.
We don't know whether any of these credentials were how INSOMNIA gained initial access.
What industries INSOMNIA targets
Sector identified for 37 of 51 victims.
| Healthcare | 16 | |
| Legal | 7 | |
| Manufacturing | 6 | |
| Non-profit | 2 | |
| Logistics | 1 | |
| Government | 1 | |
| Financial Services | 1 | |
| Hospitality | 1 |
Where the victims are located
Country identified for 48 of 51 victims.
| United States | 42 | |
| Brazil | 2 | |
| Singapore | 2 | |
| Thailand | 1 | |
| China | 1 |
Most recent INSOMNIA victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| NorthShore Health Centers northshorehealth.org | Healthcare | United States | Sep 8, 2026 |
| Metro Tulsa Foot & Ankle Specialists tulsafoot.com | Healthcare | United States | Sep 1, 2026 |
| Aurora Health Management aurorahealthmgt.com | Healthcare | United States | Aug 20, 2026 |
| Codinter codinter.com | Manufacturing | Not identified | Aug 19, 2026 |
| Park Place Behavioral Health Care ppbh.org | Not identified | Not identified | Aug 7, 2026 |
| Laempe Reich laempereich.com | Not identified | United States | Aug 3, 2026 |
| Merritt Woodwork merrittwoodwork.com | Manufacturing | United States | Aug 3, 2026 |
| Sky Solutions Panama skysolutions.com.pa | Telecommunications | Not identified | Jul 30, 2026 |
| Brooklyn Defender Services bds.org | Legal | United States | Jul 27, 2026 |
| The Vant Group thevantgroup.com | Not identified | United States | Jun 15, 2026 |
| Mid Cumberland Human Resource Agency mchra.com | Non-profit | United States | Jun 10, 2026 |
| Nephrology Associates, PA arnapa.com | Not identified | United States | Apr 29, 2026 |
| METO Systems metosystems.com | Manufacturing | United States | Apr 27, 2026 |
| United Medical Doctors unitedmd.com | Healthcare | United States | Apr 10, 2026 |
| Noble Oilfield Services nobleoilfieldservices.com | Energy | United States | Apr 8, 2026 |
| Atlas Ocean Voyages atlasoceanvoyages.com | Hospitality | United States | Mar 24, 2026 |
| Valley Family Health Care vfhc.org | Non-profit | United States | Mar 19, 2026 |
| Belmont Plastic Surgery belmontplasticsurgeryva.com | Healthcare | United States | Mar 4, 2026 |
| Ripple Neuro rippleneuro.com | Healthcare | United States | Feb 27, 2026 |
| Thrash Commercial Contractors thrashco.com | Not identified | United States | Feb 27, 2026 |
Showing the 20 most recent of 51. Browse recent data breaches for more.
INSOMNIA leak sites
Addresses we've seen INSOMNIA publish victims from. Any .onion address needs the Tor Browser.
i62huw7ve22rpyw6lnq3kmfump2dmsg4xpveec3ere73njwatrz74gad.onionr3keoxye5mki4fqcvlk4hpfqqzxmakchjpmem7oppynobcieamdbmcyd.onionpeargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion
INSOMNIA questions
Is INSOMNIA still active?
Yes. INSOMNIA posted its most recent victim on September 8, 2026. That's 4 victims in the last 30 days.
How many victims has INSOMNIA claimed?
INSOMNIA has named 51 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did INSOMNIA first appear?
The first victim we recorded for INSOMNIA was posted on February 9, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does INSOMNIA target?
Healthcare accounts for the most victims we can classify, with 16. Legal follows at 7. We could identify a sector for 37 of 51 victims, so treat this as the shape of the targeting rather than a full census.
Has INSOMNIA already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.