Kazu
Data as of August 16, 2026.
Credential exposure before the attack
13.5% of Kazu victims whose domain we can identify (5 of 37) had employee credentials leak in the 12 months before Kazu named them as a victim.
We don't know whether any of these credentials were how Kazu gained initial access.
What industries Kazu targets
Sector identified for 26 of 37 victims.
| Government | 15 | |
| Healthcare | 6 | |
| Education | 3 | |
| Legal | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 28 of 37 victims.
| Mexico | 10 | |
| Colombia | 3 | |
| Thailand | 3 | |
| United Arab Emirates | 3 | |
| Saudi Arabia | 2 | |
| United States | 2 | |
| Argentina | 2 | |
| United Kingdom | 1 |
Most recent Kazu victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| zHealth EHR zhealthehr.com | Healthcare | United States | Jan 27, 2026 |
| MyVete myvete.com | Healthcare | United States | Jan 13, 2026 |
| Manage My Health managemyhealth.co.nz | Healthcare | New Zealand | Dec 30, 2025 |
| Saudi Icon saudi-icon.com | Healthcare | Saudi Arabia | Dec 30, 2025 |
| CT Dent ct-dent.co.uk | Healthcare | United Kingdom | Dec 8, 2025 |
| Armada Boliviana armada.mil.bo | Not identified | Not identified | Nov 11, 2025 |
| Armada Nacional de Colombia armada.mil.co | Not identified | Colombia | Nov 11, 2025 |
| Comando General de las Fuerzas Militares de Colombia cgfm.mil.co | Not identified | Colombia | Nov 11, 2025 |
| Corporación del Seguro Social Militar cossmil.mil.bo | Healthcare | Not identified | Nov 11, 2025 |
| DIF Guadalajara difgdl.gob.mx | Government | Mexico | Nov 11, 2025 |
| Department of Agricultural Extension doae.go.th | Government | Thailand | Nov 11, 2025 |
| Argentina’s Ministry of Education educacion.gob.ar | Education | Argentina | Nov 11, 2025 |
| Emirates Red Crescent emiratesrc.ae | Not identified | United Arab Emirates | Nov 11, 2025 |
| Servicio Nacional de Empleo empleo.gob.mx | Government | Mexico | Nov 11, 2025 |
| Empleos Clarin clarin.com | Not identified | Argentina | Nov 11, 2025 |
| Fiscalía General del Estado de San Luis Potosí fiscaliaslp.gob.mx | Legal | Mexico | Nov 11, 2025 |
| Ministry of Health Sri Lanka health.gov.lk | Government | Not identified | Nov 11, 2025 |
| Peyman Etehad Karyabihaye Aryaie iranjob.ir | Not identified | Not identified | Nov 11, 2025 |
| Ministry of Public Works mpw.gov.kw | Government | Not identified | Nov 11, 2025 |
| Municipio de Querétaro municipiodequeretaro.gob.mx | Government | Mexico | Nov 11, 2025 |
Showing the 20 most recent of 37. Browse recent data breaches for more.
Kazu leak site
The address we've seen Kazu publish victims from. Any .onion address needs the Tor Browser.
6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion
Kazu questions
Is Kazu still active?
It's gone quiet. The last victim we recorded was January 27, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has Kazu claimed?
Kazu has named 37 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Kazu first appear?
The first victim we recorded for Kazu was posted on November 11, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Kazu target?
Government accounts for the most victims we can classify, with 15. Healthcare follows at 6. We could identify a sector for 26 of 37 victims, so treat this as the shape of the targeting rather than a full census.
Has Kazu already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.