Kawa4096
Data as of August 16, 2026.
What industries Kawa4096 targets
Sector identified for 8 of 11 victims.
| Financial Services | 2 | |
| Non-profit | 2 | |
| Healthcare | 2 | |
| Technology | 1 | |
| Construction | 1 |
Where the victims are located
Country identified for 4 of 11 victims.
| United States | 2 | |
| Germany | 1 | |
| Japan | 1 |
Every Kawa4096 victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| ARCON Associates arconassoc.com | Construction | Not identified | Jul 28, 2025 |
| CareSTL Health carestlhealth.org | Healthcare | United States | Jul 22, 2025 |
| ICM Document Solutions icmconv.com | Technology | Not identified | Jul 22, 2025 |
| Susan B. Allen Memorial Hospital sbamh.org | Healthcare | Not identified | Jul 22, 2025 |
| Gateway Community Service Board gatewaycsb.org | Non-profit | Not identified | Jul 8, 2025 |
| Gateway Community Service Board (Gateway CSB) gatewaycsb.org | Non-profit | Not identified | Jul 8, 2025 |
| HEIM & HAUS heimhaus.de | Not identified | Germany | Jul 8, 2025 |
| Tokio Marine & Nichido Fire Insurance tokiomarine-nichido.co.jp | Financial Services | Japan | Jul 8, 2025 |
| Oriental Guard Research ogr-jp.com | Not identified | Not identified | Jul 2, 2025 |
| MaloneBailey malonebailey.com | Financial Services | United States | Jul 1, 2025 |
| Morningside Services morningsideservices.com | Not identified | Not identified | Jun 30, 2025 |
Browse recent data breaches for more.
Kawa4096 leak sites
Addresses we've seen Kawa4096 publish victims from. Any .onion address needs the Tor Browser.
kawasax2yghpkcxx5d5fegnjoucwxnjpxcxpfh2vjfx7drj66pnwl3ad.onionkawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd.onion
Kawa4096 questions
Is Kawa4096 still active?
Not for over a year. The last victim we recorded was July 28, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Kawa4096 claimed?
Kawa4096 has named 11 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Kawa4096 first appear?
The first victim we recorded for Kawa4096 was posted on June 30, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Kawa4096 target?
Financial Services accounts for the most victims we can classify, with 2. Non-profit follows at 2. We could identify a sector for 8 of 11 victims, so treat this as the shape of the targeting rather than a full census.
Has Kawa4096 already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.