LGroup
Data as of August 16, 2026.
Credential exposure before the attack
11.5% of LGroup victims whose domain we can identify (3 of 26) had employee credentials leak in the 12 months before LGroup named them as a victim.
We don't know whether any of these credentials were how LGroup gained initial access.
What industries LGroup targets
Sector identified for 5 of 26 victims.
| Energy | 1 | |
| Telecommunications | 1 | |
| Financial Services | 1 | |
| Education | 1 | |
| Manufacturing | 1 |
Where the victims are located
Country identified for 11 of 26 victims.
| Argentina | 2 | |
| Brazil | 2 | |
| Australia | 1 | |
| France | 1 | |
| Hungary | 1 | |
| Luxembourg | 1 | |
| Vietnam | 1 | |
| China | 1 |
Most recent LGroup victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| ATP Chaco chaco.gob.ar | Not identified | Argentina | Aug 7, 2026 |
| AUSFEC ausfec1.com.au | Not identified | Australia | Aug 7, 2026 |
| Automobile Müller automobile-mueller.info | Not identified | Not identified | Aug 7, 2026 |
| Bouygues Energies bouygues-es.fr | Energy | France | Aug 7, 2026 |
| BR.Digital Telecommunications brdigital.net.br | Telecommunications | Brazil | Aug 7, 2026 |
| Coast Produce coastproduce.com | Not identified | Not identified | Aug 7, 2026 |
| Cookie\'s Kids cookieskids.com | Not identified | Not identified | Aug 7, 2026 |
| Dayco Host daycohost.com | Not identified | Not identified | Aug 7, 2026 |
| Desert Orthopaedic Center doclv.com | Not identified | Not identified | Aug 7, 2026 |
| Ferretornillos ferretornillos.com | Not identified | Not identified | Aug 7, 2026 |
| GSL Graphic Solutions gslusa.com | Not identified | Not identified | Aug 7, 2026 |
| Immobilia immobilia.hu | Not identified | Hungary | Aug 7, 2026 |
| Jean Petit jean-petit.lu | Not identified | Luxembourg | Aug 7, 2026 |
| Le & Associates l-a.com.vn | Not identified | Vietnam | Aug 7, 2026 |
| Laticrete laticrete.com.cn | Not identified | China | Aug 7, 2026 |
| Goalseek mygoalseek.com | Financial Services | Not identified | Aug 7, 2026 |
| NoKota Packers nokotapackers.com | Not identified | Not identified | Aug 7, 2026 |
| Onsite Engineering onsite-eng.ca | Not identified | Canada | Aug 7, 2026 |
| Prosecurities psec.com.ar | Not identified | Argentina | Aug 7, 2026 |
| Rachel Julien racheljulien.com | Not identified | Not identified | Aug 7, 2026 |
Showing the 20 most recent of 26. Browse recent data breaches for more.
LGroup leak site
The address we've seen LGroup publish victims from. Any .onion address needs the Tor Browser.
4zrjdyuq4sjogm2epwwoleegquavhwo3o7fakstnlgox6guqt3qpe4qd.onion
LGroup questions
Is LGroup still active?
Yes. LGroup posted its most recent victim on August 7, 2026. That's 26 victims in the last 30 days.
How many victims has LGroup claimed?
LGroup has named 26 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did LGroup first appear?
The first victim we recorded for LGroup was posted on August 7, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does LGroup target?
Energy accounts for the most victims we can classify, with 1. Telecommunications follows at 1. We could identify a sector for 5 of 26 victims, so treat this as the shape of the targeting rather than a full census.
Has LGroup already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.