KRYBIT

Active
151 victims named on the leak site
35 in the last 30 days
150 in the last 12 months
Apr 2026 first victim we recorded
Sep 25, 2026 most recent victim posted
5 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

15.2% of KRYBIT victims whose domain we can identify (23 of 151) had employee credentials leak in the 12 months before KRYBIT named them as a victim.

We don't know whether any of these credentials were how KRYBIT gained initial access.

What industries KRYBIT targets

Sector identified for 123 of 151 victims.

Manufacturing34
Healthcare18
Construction15
Financial Services10
Education9
Logistics8
Government7
Technology6

Where the victims are located

Country identified for 125 of 151 victims.

India13
United States11
Thailand10
Germany8
Mexico8
France6
Brazil5
United Arab Emirates5

Most recent KRYBIT victims

VictimSectorCountryPosted
Air Tanzania airtanzania.comNot identifiedNot identifiedSep 25, 2026
Efada Law Firm and Legal Consultations efada.saLegalSaudi ArabiaSep 25, 2026
Jones the Grocer jonesthegrocer.comRetailUnited Arab EmiratesSep 25, 2026
Ahluwalia Contracts acilnet.comConstructionIndiaSep 21, 2026
Diakoniewerk Apolda diakonie-apolda.deNon-profitGermanySep 18, 2026
Harput Yapı harputyapi.comConstructionTurkeySep 18, 2026
Capricorn Logistics capricornlogistics.comLogisticsIndiaSep 14, 2026
Egyptian Airports eac-airports.comGovernmentEgyptSep 14, 2026
ERACM eracm.frEducationFranceSep 14, 2026
Ibn Sina Trust ibnsinatrust.comHealthcareNot identifiedSep 14, 2026
International Thermal Insulation & Fire Protection intherpro.comNot identifiedUnited Arab EmiratesSep 14, 2026
Kashkha kashkha.comManufacturingUnited Arab EmiratesSep 14, 2026
La Sultana Hotels lasultanahotels.comHospitalityNot identifiedSep 14, 2026
Meridian 16 Business Park meridian16.hrManufacturingCroatiaSep 14, 2026
Metalware metalware.caManufacturingCanadaSep 14, 2026
Professional Security Services pss.htNot identifiedNot identifiedSep 14, 2026
Swadeshi Civil Infrastructure swadeshicipl.comConstructionIndiaSep 14, 2026
Tender tender.mxNot identifiedMexicoSep 14, 2026
Tiflis Palace tiflispalace.geHospitalityUnited StatesSep 14, 2026
Instituto de Cancerología incan.org.gtHealthcareNot identifiedSep 4, 2026

Showing the 20 most recent of 151. Browse recent data breaches for more.

KRYBIT leak sites

Addresses we've seen KRYBIT publish victims from. Any .onion address needs the Tor Browser.

  • krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion
  • krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion
  • krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion
  • ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
  • j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion

KRYBIT questions

Is KRYBIT still active?

Yes. KRYBIT posted its most recent victim on September 25, 2026. That's 35 victims in the last 30 days.

How many victims has KRYBIT claimed?

KRYBIT has named 151 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 150 of them were posted in the last 12 months.

When did KRYBIT first appear?

The first victim we recorded for KRYBIT was posted on April 6, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does KRYBIT target?

Manufacturing accounts for the most victims we can classify, with 34. Healthcare follows at 18. We could identify a sector for 123 of 151 victims, so treat this as the shape of the targeting rather than a full census.

Has KRYBIT already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.