LGroup
Data as of September 14, 2026.
Credential exposure before the attack
10.7% of LGroup victims whose domain we can identify (3 of 28) had employee credentials leak in the 12 months before LGroup named them as a victim.
We don't know whether any of these credentials were how LGroup gained initial access.
What industries LGroup targets
Sector identified for 7 of 28 victims.
| Financial Services | 2 | |
| Energy | 1 | |
| Telecommunications | 1 | |
| Education | 1 | |
| Manufacturing | 1 | |
| Non-profit | 1 |
Where the victims are located
Country identified for 13 of 28 victims.
| Argentina | 2 | |
| Brazil | 2 | |
| United States | 2 | |
| Australia | 1 | |
| France | 1 | |
| Hungary | 1 | |
| Luxembourg | 1 | |
| Vietnam | 1 |
Most recent LGroup victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| CompEndium Services compendiumusa.net | Financial Services | United States | Aug 24, 2026 |
| Cedar Ridge Ministries cedarridge.org | Non-profit | United States | Aug 22, 2026 |
| ATP Chaco chaco.gob.ar | Not identified | Argentina | Aug 7, 2026 |
| AUSFEC ausfec1.com.au | Not identified | Australia | Aug 7, 2026 |
| Automobile Müller automobile-mueller.info | Not identified | Not identified | Aug 7, 2026 |
| Bouygues Energies bouygues-es.fr | Energy | France | Aug 7, 2026 |
| BR.Digital Telecommunications brdigital.net.br | Telecommunications | Brazil | Aug 7, 2026 |
| Coast Produce coastproduce.com | Not identified | Not identified | Aug 7, 2026 |
| Cookie\'s Kids cookieskids.com | Not identified | Not identified | Aug 7, 2026 |
| Dayco Host daycohost.com | Not identified | Not identified | Aug 7, 2026 |
| Desert Orthopaedic Center doclv.com | Not identified | Not identified | Aug 7, 2026 |
| Ferretornillos ferretornillos.com | Not identified | Not identified | Aug 7, 2026 |
| GSL Graphic Solutions gslusa.com | Not identified | Not identified | Aug 7, 2026 |
| Immobilia immobilia.hu | Not identified | Hungary | Aug 7, 2026 |
| Jean Petit jean-petit.lu | Not identified | Luxembourg | Aug 7, 2026 |
| Le & Associates l-a.com.vn | Not identified | Vietnam | Aug 7, 2026 |
| Laticrete laticrete.com.cn | Not identified | China | Aug 7, 2026 |
| Goalseek mygoalseek.com | Financial Services | Not identified | Aug 7, 2026 |
| NoKota Packers nokotapackers.com | Not identified | Not identified | Aug 7, 2026 |
| Onsite Engineering onsite-eng.ca | Not identified | Canada | Aug 7, 2026 |
Showing the 20 most recent of 28. Browse recent data breaches for more.
LGroup leak site
The address we've seen LGroup publish victims from. Any .onion address needs the Tor Browser.
4zrjdyuq4sjogm2epwwoleegquavhwo3o7fakstnlgox6guqt3qpe4qd.onion
LGroup questions
Is LGroup still active?
Yes. LGroup posted its most recent victim on August 24, 2026. That's 2 victims in the last 30 days.
How many victims has LGroup claimed?
LGroup has named 28 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did LGroup first appear?
The first victim we recorded for LGroup was posted on August 7, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does LGroup target?
Financial Services accounts for the most victims we can classify, with 2. Energy follows at 1. We could identify a sector for 7 of 28 victims, so treat this as the shape of the targeting rather than a full census.
Has LGroup already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.