JGroup
Data as of August 16, 2026.
Credential exposure before the attack
23.1% of JGroup victims whose domain we can identify (9 of 39) had employee credentials leak in the 12 months before JGroup named them as a victim.
We don't know whether any of these credentials were how JGroup gained initial access.
What industries JGroup targets
Sector identified for 21 of 39 victims.
| Construction | 6 | |
| Manufacturing | 5 | |
| Energy | 3 | |
| Technology | 2 | |
| Financial Services | 1 | |
| Telecommunications | 1 | |
| Education | 1 | |
| Hospitality | 1 |
Where the victims are located
Country identified for 29 of 39 victims.
| United States | 5 | |
| France | 4 | |
| United Kingdom | 4 | |
| Argentina | 3 | |
| Australia | 2 | |
| Brazil | 2 | |
| Germany | 2 | |
| Luxembourg | 1 |
Most recent JGroup victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| IKAD Engineering ikad.com.au | Manufacturing | Australia | Nov 10, 2025 |
| Dimensional Control Systems 3dcs.com | Technology | United States | Oct 2, 2025 |
| AZPRO azprogroup.com | Retail | United States | Oct 1, 2025 |
| Multi-media systeme mmsag.de | Not identified | Germany | Oct 1, 2025 |
| J. E. Stacey jestacey.com | Construction | United Kingdom | Sep 30, 2025 |
| Petro Diamond petrodiamond.com | Energy | United States | Sep 30, 2025 |
| Raimore Construction raimore.com | Construction | United States | Sep 30, 2025 |
| Virtual Projects virtualprojects.build | Construction | Egypt | Sep 30, 2025 |
| FAI Aviation Group fai.ag | Not identified | Germany | Sep 24, 2025 |
| Gimaex gimaex.com | Manufacturing | France | Aug 21, 2025 |
| Southwest Stone southweststone.net | Not identified | United States | Aug 20, 2025 |
| Automatización y Modernización aym.com.mx | Construction | Mexico | Aug 6, 2025 |
| PPM Recruitment ppmrecruit.com | Construction | United Kingdom | Aug 6, 2025 |
| Bridge Recruitment Services bridgerecruit.co.uk | Construction | United Kingdom | Aug 1, 2025 |
| Restiani restiani.com | Energy | Italy | Jul 31, 2025 |
| GIMAEX International gimaex.com | Manufacturing | France | Jul 30, 2025 |
| Cyber Infrastructure cisin.com | Technology | Not identified | Jun 23, 2025 |
| Diffazur diffazur.fr | Manufacturing | France | Jun 23, 2025 |
| Fecovita fecovita.com | Not identified | Argentina | Jun 23, 2025 |
| Powells powells.biz | Hospitality | Not identified | Jun 23, 2025 |
Showing the 20 most recent of 39. Browse recent data breaches for more.
JGroup leak sites
Addresses we've seen JGroup publish victims from. Any .onion address needs the Tor Browser.
twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onionshare.jtor.xyz
JGroup questions
Is JGroup still active?
It's gone quiet. The last victim we recorded was November 10, 2025, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has JGroup claimed?
JGroup has named 39 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 11 of them were posted in the last 12 months.
When did JGroup first appear?
The first victim we recorded for JGroup was posted on May 5, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does JGroup target?
Construction accounts for the most victims we can classify, with 6. Manufacturing follows at 5. We could identify a sector for 21 of 39 victims, so treat this as the shape of the targeting rather than a full census.
Has JGroup already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.