KRYBIT
Data as of August 16, 2026.
Credential exposure before the attack
14.3% of KRYBIT victims whose domain we can identify (14 of 98) had employee credentials leak in the 12 months before KRYBIT named them as a victim.
We don't know whether any of these credentials were how KRYBIT gained initial access.
What industries KRYBIT targets
Sector identified for 80 of 98 victims.
| Manufacturing | 27 | |
| Construction | 9 | |
| Financial Services | 9 | |
| Healthcare | 9 | |
| Education | 6 | |
| Technology | 5 | |
| Government | 5 | |
| Logistics | 3 |
Where the victims are located
Country identified for 82 of 98 victims.
| United States | 10 | |
| Mexico | 6 | |
| Germany | 5 | |
| India | 5 | |
| France | 5 | |
| Brazil | 4 | |
| South Africa | 4 | |
| Thailand | 4 |
Most recent KRYBIT victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| HISS hisstw.com | Manufacturing | Taiwan | Aug 13, 2026 |
| Labindia labindia.com | Manufacturing | India | Aug 13, 2026 |
| Lee Huat Yap Kee lhyk.com.sg | Manufacturing | Singapore | Aug 13, 2026 |
| APSA Internacional apsanet.com.ar | Not identified | Argentina | Aug 12, 2026 |
| Kilpi-Koskinen Oy kilpi-koskinen.fi | Manufacturing | Finland | Aug 12, 2026 |
| Actini Group actini.com | Manufacturing | France | Aug 10, 2026 |
| Reflet 2000 reflet2000.fr | Manufacturing | France | Aug 10, 2026 |
| ERNAT ernat-bureau-etudes.fr | Manufacturing | France | Aug 6, 2026 |
| HYMIASA hymiasa.com | Manufacturing | Mexico | Aug 6, 2026 |
| Serengeti Estates serengetiestates.co.za | Not identified | South Africa | Aug 6, 2026 |
| Galvin Brothers galvinbrothers.com | Construction | United States | Aug 5, 2026 |
| Buzz Trading 104 buzztrading104.co.za | Manufacturing | South Africa | Aug 3, 2026 |
| Country Motos countrymotors.com.mx | Automotive | Mexico | Aug 3, 2026 |
| DC Partner dcpartner.co.za | Financial Services | South Africa | Aug 3, 2026 |
| ASHA Microfinance Bank asa-international.com | Financial Services | United Kingdom | Aug 3, 2026 |
| ProHealth Medical Group prohealth.sg | Not identified | Singapore | Aug 3, 2026 |
| Mairie de Rinxent ville-rinxent.fr | Government | France | Aug 3, 2026 |
| CH. Karnchang chkck.com | Construction | Thailand | Jul 24, 2026 |
| The DeBruler debrulerco.com | Construction | United States | Jul 24, 2026 |
| Laxai Life Sciences laxai.com | Manufacturing | India | Jul 24, 2026 |
Showing the 20 most recent of 98. Browse recent data breaches for more.
KRYBIT leak sites
Addresses we've seen KRYBIT publish victims from. Any .onion address needs the Tor Browser.
krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onionkrybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onionkrybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onionijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onionj75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion
KRYBIT questions
Is KRYBIT still active?
Yes. KRYBIT posted its most recent victim on August 13, 2026. That's 29 victims in the last 30 days.
How many victims has KRYBIT claimed?
KRYBIT has named 98 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 97 of them were posted in the last 12 months.
When did KRYBIT first appear?
The first victim we recorded for KRYBIT was posted on April 6, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does KRYBIT target?
Manufacturing accounts for the most victims we can classify, with 27. Construction follows at 9. We could identify a sector for 80 of 98 victims, so treat this as the shape of the targeting rather than a full census.
Has KRYBIT already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.