INSOMNIA

Active
54 victims named on the leak site
5 in the last 30 days
54 in the last 12 months
Feb 2026 first victim we recorded
Sep 16, 2026 most recent victim posted
3 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

13% of INSOMNIA victims whose domain we can identify (7 of 54) had employee credentials leak in the 12 months before INSOMNIA named them as a victim.

We don't know whether any of these credentials were how INSOMNIA gained initial access.

What industries INSOMNIA targets

Sector identified for 40 of 54 victims.

Healthcare17
Legal9
Manufacturing6
Non-profit2
Logistics1
Government1
Financial Services1
Hospitality1

Where the victims are located

Country identified for 51 of 54 victims.

United States45
Brazil2
Singapore2
Thailand1
China1

Most recent INSOMNIA victims

VictimSectorCountryPosted
Wiggins, Childs, Pantazis, Fisher, & Goldfarb wigginschilds.comLegalUnited StatesSep 16, 2026
Agape Health Services agapechc.orgHealthcareUnited StatesSep 15, 2026
Massey, Stotser & Nichols msnattorneys.comLegalUnited StatesSep 15, 2026
NorthShore Health Centers northshorehealth.orgHealthcareUnited StatesSep 8, 2026
Metro Tulsa Foot & Ankle Specialists tulsafoot.comHealthcareUnited StatesSep 1, 2026
Aurora Health Management aurorahealthmgt.comHealthcareUnited StatesAug 20, 2026
Codinter codinter.comManufacturingNot identifiedAug 19, 2026
Park Place Behavioral Health Care ppbh.orgNot identifiedNot identifiedAug 7, 2026
Laempe Reich laempereich.comNot identifiedUnited StatesAug 3, 2026
Merritt Woodwork merrittwoodwork.comManufacturingUnited StatesAug 3, 2026
Sky Solutions Panama skysolutions.com.paTelecommunicationsNot identifiedJul 30, 2026
Brooklyn Defender Services bds.orgLegalUnited StatesJul 27, 2026
The Vant Group thevantgroup.comNot identifiedUnited StatesJun 15, 2026
Mid Cumberland Human Resource Agency mchra.comNon-profitUnited StatesJun 10, 2026
Nephrology Associates, PA arnapa.comNot identifiedUnited StatesApr 29, 2026
METO Systems metosystems.comManufacturingUnited StatesApr 27, 2026
United Medical Doctors unitedmd.comHealthcareUnited StatesApr 10, 2026
Noble Oilfield Services nobleoilfieldservices.comEnergyUnited StatesApr 8, 2026
Atlas Ocean Voyages atlasoceanvoyages.comHospitalityUnited StatesMar 24, 2026
Valley Family Health Care vfhc.orgNon-profitUnited StatesMar 19, 2026

Showing the 20 most recent of 54. Browse recent data breaches for more.

INSOMNIA leak sites

Addresses we've seen INSOMNIA publish victims from. Any .onion address needs the Tor Browser.

  • i62huw7ve22rpyw6lnq3kmfump2dmsg4xpveec3ere73njwatrz74gad.onion
  • r3keoxye5mki4fqcvlk4hpfqqzxmakchjpmem7oppynobcieamdbmcyd.onion
  • peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion

INSOMNIA questions

Is INSOMNIA still active?

Yes. INSOMNIA posted its most recent victim on September 16, 2026. That's 5 victims in the last 30 days.

How many victims has INSOMNIA claimed?

INSOMNIA has named 54 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did INSOMNIA first appear?

The first victim we recorded for INSOMNIA was posted on February 9, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does INSOMNIA target?

Healthcare accounts for the most victims we can classify, with 17. Legal follows at 9. We could identify a sector for 40 of 54 victims, so treat this as the shape of the targeting rather than a full census.

Has INSOMNIA already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.