Karakurt
Data as of August 16, 2026.
Credential exposure before the attack
8.8% of Karakurt victims whose domain we can identify (8 of 91) had employee credentials leak in the 12 months before Karakurt named them as a victim.
We don't know whether any of these credentials were how Karakurt gained initial access.
What industries Karakurt targets
Sector identified for 54 of 91 victims.
| Healthcare | 14 | |
| Manufacturing | 9 | |
| Education | 6 | |
| Construction | 4 | |
| Retail | 4 | |
| Energy | 4 | |
| Real Estate | 3 | |
| Media | 2 |
Where the victims are located
Country identified for 18 of 91 victims.
| Canada | 3 | |
| Turkey | 3 | |
| Greece | 2 | |
| Australia | 2 | |
| Germany | 1 | |
| China | 1 | |
| United Kingdom | 1 | |
| Mexico | 1 |
Most recent Karakurt victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| hospiceofhuntington.org | Not identified | Not identified | Oct 6, 2023 |
| Yakima Valley Radiology yakrad.com | Healthcare | Not identified | Sep 25, 2023 |
| Regional Family Medicine (fka Kerr Medical Clinic) rfmmh.com | Healthcare | Not identified | Sep 7, 2023 |
| Goodwill goodwill.org | Education | Not identified | Aug 31, 2023 |
| COSI cosi.org | Not identified | Not identified | Aug 3, 2023 |
| alinabal.com | Manufacturing | Not identified | Jul 31, 2023 |
| McAlester Regional Health Center mrhcok.com | Healthcare | Not identified | Jul 31, 2023 |
| Jefferson County Health Center jeffersoncountyhealthcenter.org | Healthcare | Not identified | Jul 4, 2023 |
| CentroMed centromedsa.com | Healthcare | Not identified | Jun 29, 2023 |
| Gibson Technical Center rs-wolves.com | Education | Not identified | Jun 27, 2023 |
| yokohama-oht.com | Manufacturing | Not identified | Jun 22, 2023 |
| Beacon ABA Services beaconservices.org | Not identified | Not identified | Jun 6, 2023 |
| Chattanooga Heart Institute chattanoogaheart.com | Not identified | Not identified | Jun 2, 2023 |
| York County School of Technology ytech.edu | Education | Not identified | May 16, 2023 |
| osv.com | Media | Not identified | May 1, 2023 |
| Wynn-Reeth wynn-reeth.com | Not identified | Not identified | May 1, 2023 |
| laredhealthcenter.org | Healthcare | Not identified | Apr 28, 2023 |
| lifelinevascular.com | Healthcare | Not identified | Apr 25, 2023 |
| winonapowder.com | Not identified | Not identified | Apr 25, 2023 |
| phealthcenter.org | Not identified | Not identified | Apr 21, 2023 |
Showing the 20 most recent of 91. Browse recent data breaches for more.
Karakurt leak sites
Addresses we've seen Karakurt publish victims from. Any .onion address needs the Tor Browser.
3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onionjbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onionhl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onion
Karakurt questions
Is Karakurt still active?
Not for over a year. The last victim we recorded was October 6, 2023. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Karakurt claimed?
Karakurt has named 91 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Karakurt first appear?
The first victim we recorded for Karakurt was posted on October 18, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Karakurt target?
Healthcare accounts for the most victims we can classify, with 14. Manufacturing follows at 9. We could identify a sector for 54 of 91 victims, so treat this as the shape of the targeting rather than a full census.
Has Karakurt already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.