KAIROS
Data as of August 16, 2026.
Credential exposure before the attack
36.6% of KAIROS victims whose domain we can identify (30 of 82) had employee credentials leak in the 12 months before KAIROS named them as a victim.
We don't know whether any of these credentials were how KAIROS gained initial access.
What industries KAIROS targets
Sector identified for 50 of 82 victims.
| Healthcare | 12 | |
| Legal | 7 | |
| Education | 7 | |
| Manufacturing | 5 | |
| Financial Services | 5 | |
| Real Estate | 4 | |
| Government | 3 | |
| Retail | 2 |
Where the victims are located
Country identified for 44 of 82 victims.
| United States | 17 | |
| Australia | 8 | |
| United Kingdom | 6 | |
| Canada | 2 | |
| France | 2 | |
| Germany | 2 | |
| India | 1 | |
| Denmark | 1 |
Most recent KAIROS victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Hightech Signs htsva.com | Construction | United States | Aug 13, 2026 |
| Warwick Fabrics warwick.co.nz | Not identified | New Zealand | Jul 31, 2026 |
| Thermalex tmxinc.com | Manufacturing | United States | Jul 27, 2026 |
| LR Reed lrreed.com.au | Real Estate | Australia | Jul 23, 2026 |
| College O\'Sullivan de Québec osullivan-quebec.qc.ca | Financial Services | Canada | Jul 21, 2026 |
| Camiers camiers.fr | Government | France | Jun 1, 2026 |
| McCarthy mccarthyinc.com | Construction | United States | May 18, 2026 |
| ARWINI arwini.de | Not identified | Germany | May 12, 2026 |
| Ayuntamiento de Valdemoro valdemoro.es | Government | Spain | May 12, 2026 |
| Houk Air Conditioning houkac.com | Not identified | United States | May 7, 2026 |
| Gregory Jewellers gregoryjewellers.com.au | Not identified | Australia | Apr 23, 2026 |
| Nordenta nordenta.dk | Healthcare | Denmark | Apr 21, 2026 |
| Colonial Presbyterian Church colonialkc.org | Not identified | United States | Apr 20, 2026 |
| South Florida Injury Centers sflchiro.com | Healthcare | United States | Apr 20, 2026 |
| Strata Republic stratarepublic.com.au | Real Estate | Australia | Apr 20, 2026 |
| Friendly Care friendlycare.com.au | Healthcare | Australia | Apr 16, 2026 |
| Pullen Moving pullenmoving.com | Not identified | United States | Apr 14, 2026 |
| Resch Maschinenbau resch-maschinenbau.de | Manufacturing | Germany | Mar 23, 2026 |
| Cabinet Follet and Rivoire Avocats follet-rivoire-avocats.com | Legal | France | Mar 17, 2026 |
| Instituto de Previsión Social ips.gov.py | Healthcare | Not identified | Mar 11, 2026 |
Showing the 20 most recent of 82. Browse recent data breaches for more.
KAIROS leak sites
Addresses we've seen KAIROS publish victims from. Any .onion address needs the Tor Browser.
nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.oniondngqgtcqcz5hgjvk4encs4vfyzucx3gtmov5a4eltvovux4nvazbx6ad.onioncvfgzmrcam5efoqx4lkdejv5nb6icocsla2tn2dzw4b7wlyf4luz7fyd.onionkairosgeuzkzz3ajntqcyxl3ib36szz3mg62mb3zbui33pbk3uzo4qqd.oniondwgxeoaqykd3zdkhol5xpgsqabp4lys4ea7qpl3f2b75b2sdsex644id.onionesmhbczpio7umfnxog6bk23q3nok5fjuik2dttegvezqngg2oqklo7yd.onion2msn5sp3af3iy2ozj4235ccsb7pnpp4tkzyxdpzutyc2sxb3mujicfyd.onionwhodusp3s2z6rnenxhv7scc2w5fzsse5cmijll2vl7fo6ezk45zssjqd.onionkhom5v7vmc2nomkze64dsbyenn3wlxkewg6dbsvt5sujl2rmrtfy4oid.onion
KAIROS questions
Is KAIROS still active?
Yes. KAIROS posted its most recent victim on August 13, 2026. That's 5 victims in the last 30 days.
How many victims has KAIROS claimed?
KAIROS has named 82 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 36 of them were posted in the last 12 months.
When did KAIROS first appear?
The first victim we recorded for KAIROS was posted on November 13, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does KAIROS target?
Healthcare accounts for the most victims we can classify, with 12. Legal follows at 7. We could identify a sector for 50 of 82 victims, so treat this as the shape of the targeting rather than a full census.
Has KAIROS already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.