Knight
Data as of August 16, 2026.
Credential exposure before the attack
2.1% of Knight victims whose domain we can identify (1 of 47) had employee credentials leak in the 12 months before Knight named them as a victim.
We don't know whether any of these credentials were how Knight gained initial access.
What industries Knight targets
Sector identified for 26 of 47 victims.
| Logistics | 5 | |
| Healthcare | 4 | |
| Manufacturing | 3 | |
| Financial Services | 3 | |
| Construction | 2 | |
| Automotive | 2 | |
| Energy | 2 | |
| Government | 1 |
Where the victims are located
Country identified for 23 of 47 victims.
| Brazil | 6 | |
| Italy | 5 | |
| Thailand | 2 | |
| Colombia | 2 | |
| Ireland | 1 | |
| India | 1 | |
| Chile | 1 | |
| Germany | 1 |
Most recent Knight victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| AS&A Calidad abelsantosyasoc.com.ar | Not identified | Argentina | Feb 8, 2024 |
| DGX dgxglobal.com | Logistics | Not identified | Feb 8, 2024 |
| Dirox dirox.com | Not identified | Not identified | Feb 8, 2024 |
| FEPCO fepco.com.co | Energy | Colombia | Feb 8, 2024 |
| Crace Medical Centre cracemc.com.au | Healthcare | Australia | Dec 18, 2023 |
| City of Defiance cityofdefiance.com | Not identified | Not identified | Dec 14, 2023 |
| daiho-gr.co.jp | Not identified | Japan | Dec 9, 2023 |
| Contitec contitec.net.br | Not identified | Brazil | Dec 4, 2023 |
| venetolog.com.br | Logistics | Brazil | Dec 4, 2023 |
| Wakefield & Associates wakeassoc.com | Financial Services | Not identified | Dec 1, 2023 |
| Dreyfuss Williams dreyfuss.com | Legal | Not identified | Nov 30, 2023 |
| Futura Fundamentsysteme futura-energiesparen.de | Energy | Germany | Nov 30, 2023 |
| Studio D.EL.LA. studiodella.it | Not identified | Italy | Nov 30, 2023 |
| Freedom Firearms & Outfitters ffando.com | Not identified | Not identified | Nov 2, 2023 |
| mcmtx.com | Not identified | Not identified | Nov 2, 2023 |
| US Claims Solutions usclaimssolutions.com | Financial Services | Not identified | Nov 2, 2023 |
| Emmea emmeasrl.it | Logistics | Italy | Oct 31, 2023 |
| Il Centro SpA ilcentro.it | Not identified | Italy | Oct 31, 2023 |
| Intellipop intellipop.co | Telecommunications | Colombia | Oct 31, 2023 |
| Michels Markisen GmbH michels.info | Construction | Not identified | Oct 31, 2023 |
Showing the 20 most recent of 47. Browse recent data breaches for more.
Knight leak sites
Addresses we've seen Knight publish victims from. Any .onion address needs the Tor Browser.
knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onionmega.nzgofile.iouzfrntnmwojla5v4w3xvpxerjg43kuzqxmtspqhi5qclwtof5ibgonyd.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onionweg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onionr6chas4skrvna72fg5ui3cqkke4fnpinsskvlo57aiolrrdb3r777mqd.onion
Knight questions
Is Knight still active?
Not for over a year. The last victim we recorded was February 8, 2024. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Knight claimed?
Knight has named 47 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Knight first appear?
The first victim we recorded for Knight was posted on January 8, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Knight target?
Logistics accounts for the most victims we can classify, with 5. Healthcare follows at 4. We could identify a sector for 26 of 47 victims, so treat this as the shape of the targeting rather than a full census.
Has Knight already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.