Kazu
Data as of September 14, 2026.
Credential exposure before the attack
14.5% of Kazu victims whose domain we can identify (8 of 55) had employee credentials leak in the 12 months before Kazu named them as a victim.
We don't know whether any of these credentials were how Kazu gained initial access.
What industries Kazu targets
Sector identified for 42 of 55 victims.
| Government | 17 | |
| Healthcare | 16 | |
| Education | 4 | |
| Technology | 2 | |
| Media | 1 | |
| Legal | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 44 of 55 victims.
| Mexico | 10 | |
| United States | 5 | |
| Argentina | 5 | |
| South Africa | 3 | |
| India | 3 | |
| Colombia | 3 | |
| Thailand | 3 | |
| United Arab Emirates | 3 |
Most recent Kazu victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Akbar Niazi Teaching Hospital anth.pk | Healthcare | Not identified | Sep 8, 2026 |
| Centro Médico Especializado OSI centromedicoosi.com | Healthcare | Peru | Sep 8, 2026 |
| Consultorio MOVIL consultoriomovil.net | Healthcare | Argentina | Sep 8, 2026 |
| Gauteng Provincial Government gauteng.gov.za | Government | South Africa | Sep 8, 2026 |
| The Gauteng City Region Academy Bursary gauteng.gov.za | Government | South Africa | Sep 8, 2026 |
| Healthdaq healthdaq.com | Healthcare | United States | Sep 8, 2026 |
| HT Medica htmedica.com | Not identified | Not identified | Sep 8, 2026 |
| Instituto Ferrero de Neurología y Sueño ifn.com.ar | Healthcare | Argentina | Sep 8, 2026 |
| Meducar meducar.com | Healthcare | Argentina | Sep 8, 2026 |
| Mobilemed mobilemed.com.br | Healthcare | Brazil | Sep 8, 2026 |
| MSM Unify msmunify.com | Education | India | Sep 8, 2026 |
| Natclar natclar.com.pe | Healthcare | Peru | Sep 8, 2026 |
| PappyJoe pappyjoe.com | Healthcare | India | Sep 8, 2026 |
| Pawlyclinic pawlyclinic.com | Healthcare | Singapore | Sep 8, 2026 |
| Statistics South Africa statssa.gov.za | Media | South Africa | Sep 8, 2026 |
| Yocale yocale.com | Technology | Canada | Sep 8, 2026 |
| Spirit Cultural Exchange spiritexchange.com | Not identified | United States | Sep 7, 2026 |
| Redacted redacted.com | Technology | United States | Aug 26, 2026 |
| zHealth EHR zhealthehr.com | Healthcare | United States | Jan 27, 2026 |
| MyVete myvete.com | Healthcare | United States | Jan 13, 2026 |
Showing the 20 most recent of 55. Browse recent data breaches for more.
Kazu leak site
The address we've seen Kazu publish victims from. Any .onion address needs the Tor Browser.
6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion
Kazu questions
Is Kazu still active?
Yes. Kazu posted its most recent victim on September 8, 2026. That's 18 victims in the last 30 days.
How many victims has Kazu claimed?
Kazu has named 55 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Kazu first appear?
The first victim we recorded for Kazu was posted on November 11, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Kazu target?
Government accounts for the most victims we can classify, with 17. Healthcare follows at 16. We could identify a sector for 42 of 55 victims, so treat this as the shape of the targeting rather than a full census.
Has Kazu already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.