KAIROS
Data as of September 16, 2026.
Credential exposure before the attack
35.7% of KAIROS victims whose domain we can identify (30 of 84) had employee credentials leak in the 12 months before KAIROS named them as a victim.
We don't know whether any of these credentials were how KAIROS gained initial access.
What industries KAIROS targets
Sector identified for 52 of 84 victims.
| Healthcare | 12 | |
| Legal | 7 | |
| Education | 7 | |
| Financial Services | 5 | |
| Manufacturing | 5 | |
| Government | 5 | |
| Real Estate | 4 | |
| Retail | 2 |
Where the victims are located
Country identified for 46 of 84 victims.
| United States | 17 | |
| Australia | 8 | |
| United Kingdom | 6 | |
| France | 3 | |
| Canada | 2 | |
| Germany | 2 | |
| Spain | 2 | |
| Taiwan | 1 |
Most recent KAIROS victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Commune of Libercourt libercourt.fr | Government | France | Sep 3, 2026 |
| Ayuntamiento de Velilla de San Antonio ayto-velilla.es | Government | Spain | Aug 21, 2026 |
| Hightech Signs htsva.com | Construction | United States | Aug 13, 2026 |
| Warwick Fabrics warwick.co.nz | Not identified | New Zealand | Jul 31, 2026 |
| Thermalex tmxinc.com | Manufacturing | United States | Jul 27, 2026 |
| LR Reed lrreed.com.au | Real Estate | Australia | Jul 23, 2026 |
| College O\'Sullivan de Québec osullivan-quebec.qc.ca | Financial Services | Canada | Jul 21, 2026 |
| Camiers camiers.fr | Government | France | Jun 1, 2026 |
| McCarthy mccarthyinc.com | Construction | United States | May 18, 2026 |
| ARWINI arwini.de | Not identified | Germany | May 12, 2026 |
| Ayuntamiento de Valdemoro valdemoro.es | Government | Spain | May 12, 2026 |
| Houk Air Conditioning houkac.com | Not identified | United States | May 7, 2026 |
| Gregory Jewellers gregoryjewellers.com.au | Not identified | Australia | Apr 23, 2026 |
| Nordenta nordenta.dk | Healthcare | Denmark | Apr 21, 2026 |
| Colonial Presbyterian Church colonialkc.org | Not identified | United States | Apr 20, 2026 |
| South Florida Injury Centers sflchiro.com | Healthcare | United States | Apr 20, 2026 |
| Strata Republic stratarepublic.com.au | Real Estate | Australia | Apr 20, 2026 |
| Friendly Care friendlycare.com.au | Healthcare | Australia | Apr 16, 2026 |
| Pullen Moving pullenmoving.com | Not identified | United States | Apr 14, 2026 |
| Resch Maschinenbau resch-maschinenbau.de | Manufacturing | Germany | Mar 23, 2026 |
Showing the 20 most recent of 84. Browse recent data breaches for more.
KAIROS leak sites
Addresses we've seen KAIROS publish victims from. Any .onion address needs the Tor Browser.
nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.oniondngqgtcqcz5hgjvk4encs4vfyzucx3gtmov5a4eltvovux4nvazbx6ad.onioncvfgzmrcam5efoqx4lkdejv5nb6icocsla2tn2dzw4b7wlyf4luz7fyd.onionkairosgeuzkzz3ajntqcyxl3ib36szz3mg62mb3zbui33pbk3uzo4qqd.oniondwgxeoaqykd3zdkhol5xpgsqabp4lys4ea7qpl3f2b75b2sdsex644id.onionesmhbczpio7umfnxog6bk23q3nok5fjuik2dttegvezqngg2oqklo7yd.onion2msn5sp3af3iy2ozj4235ccsb7pnpp4tkzyxdpzutyc2sxb3mujicfyd.onionwhodusp3s2z6rnenxhv7scc2w5fzsse5cmijll2vl7fo6ezk45zssjqd.onionkhom5v7vmc2nomkze64dsbyenn3wlxkewg6dbsvt5sujl2rmrtfy4oid.onion
KAIROS questions
Is KAIROS still active?
Yes. KAIROS posted its most recent victim on September 3, 2026. That's 2 victims in the last 30 days.
How many victims has KAIROS claimed?
KAIROS has named 84 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 36 of them were posted in the last 12 months.
When did KAIROS first appear?
The first victim we recorded for KAIROS was posted on November 13, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does KAIROS target?
Healthcare accounts for the most victims we can classify, with 12. Legal follows at 7. We could identify a sector for 52 of 84 victims, so treat this as the shape of the targeting rather than a full census.
Has KAIROS already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.