KRYBIT

Active

145 victims named on the leak site

47 in the last 30 days

144 in the last 12 months

Apr 2026 first victim we recorded

Sep 14, 2026 most recent victim posted

5 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

15.2% of KRYBIT victims whose domain we can identify (22 of 145) had employee credentials leak in the 12 months before KRYBIT named them as a victim.

We don't know whether any of these credentials were how KRYBIT gained initial access.

What industries KRYBIT targets

Sector identified for 118 of 145 victims.

Manufacturing	34
Healthcare	18
Construction	13
Financial Services	10
Education	9
Logistics	8
Government	7
Technology	6

Where the victims are located

Country identified for 120 of 145 victims.

India	12
United States	11
Thailand	10
Mexico	8
Germany	7
France	6
Brazil	5
Egypt	5

Most recent KRYBIT victims

Victim	Sector	Country	Posted
Capricorn Logistics capricornlogistics.com	Logistics	India	Sep 14, 2026
Egyptian Airports eac-airports.com	Government	Egypt	Sep 14, 2026
ERACM eracm.fr	Education	France	Sep 14, 2026
Ibn Sina Trust ibnsinatrust.com	Healthcare	Not identified	Sep 14, 2026
International Thermal Insulation & Fire Protection intherpro.com	Not identified	United Arab Emirates	Sep 14, 2026
Kashkha kashkha.com	Manufacturing	United Arab Emirates	Sep 14, 2026
La Sultana Hotels lasultanahotels.com	Hospitality	Not identified	Sep 14, 2026
Meridian 16 Business Park meridian16.hr	Manufacturing	Croatia	Sep 14, 2026
Metalware metalware.ca	Manufacturing	Canada	Sep 14, 2026
Professional Security Services pss.ht	Not identified	Not identified	Sep 14, 2026
Swadeshi Civil Infrastructure swadeshicipl.com	Construction	India	Sep 14, 2026
Tender tender.mx	Not identified	Mexico	Sep 14, 2026
Tiflis Palace tiflispalace.ge	Hospitality	United States	Sep 14, 2026
Instituto de Cancerología incan.org.gt	Healthcare	Not identified	Sep 4, 2026
Liga Nacional contra el Cáncer ligacancerguate.org	Education	Not identified	Sep 4, 2026
Alphaplantes alphaplantes.com	Not identified	Canada	Sep 2, 2026
Arab Maritime Petroleum Transport amptc.net	Logistics	Not identified	Sep 2, 2026
DMT Group dmt-group.com	Not identified	Germany	Sep 2, 2026
Holding Company for Construction & Development hccd-construction.com	Construction	Egypt	Sep 2, 2026
JSW Law jswlaw.bt	Education	Not identified	Sep 2, 2026

Showing the 20 most recent of 145. Browse recent data breaches for more.

KRYBIT leak sites

Addresses we've seen KRYBIT publish victims from. Any .onion address needs the Tor Browser.

krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion
krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion
krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion
ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion

KRYBIT questions

Is KRYBIT still active?

Yes. KRYBIT posted its most recent victim on September 14, 2026. That's 47 victims in the last 30 days.

How many victims has KRYBIT claimed?

KRYBIT has named 145 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 144 of them were posted in the last 12 months.

When did KRYBIT first appear?

The first victim we recorded for KRYBIT was posted on April 6, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does KRYBIT target?

Manufacturing accounts for the most victims we can classify, with 34. Healthcare follows at 18. We could identify a sector for 118 of 145 victims, so treat this as the shape of the targeting rather than a full census.

Has KRYBIT already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.