LV

Dark since November 29, 2022
39 victims named on the leak site
0 in the last 30 days
0 in the last 12 months
May 2022 first victim we recorded
Nov 29, 2022 most recent victim posted
2 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

15.4% of LV victims whose domain we can identify (6 of 39) had employee credentials leak in the 12 months before LV named them as a victim.

We don't know whether any of these credentials were how LV gained initial access.

What industries LV targets

Sector identified for 15 of 39 victims.

Manufacturing7
Financial Services2
Construction2
Hospitality1
Healthcare1
Legal1
Technology1

Where the victims are located

Country identified for 14 of 39 victims.

Finland2
United Kingdom2
Ireland1
Saudi Arabia1
Germany1
Italy1
Philippines1
France1

Most recent LV victims

VictimSectorCountryPosted
stibbsco.comLegalNot identifiedNov 29, 2022
visiontechnologies.comTechnologyNot identifiedNov 29, 2022
glendimplex.comManufacturingNot identifiedNov 28, 2022
grpdfond.comNot identifiedNot identifiedNov 28, 2022
unitedauto.mxNot identifiedMexicoNov 21, 2022
thewassociates.comNot identifiedNot identifiedNov 16, 2022
brazilianpetfoods.com.brNot identifiedBrazilNov 14, 2022
billsbills.comNot identifiedNot identifiedNov 9, 2022
consumax.com.arFinancial ServicesArgentinaNov 3, 2022
awesomekidsdental.comHealthcareNot identifiedNov 2, 2022
cblsys.co.ukNot identifiedUnited KingdomNov 2, 2022
gruposifu.comNot identifiedNot identifiedNov 2, 2022
kinetic.phNot identifiedPhilippinesNov 2, 2022
paramount-land.comNot identifiedNot identifiedNov 2, 2022
rougier.frNot identifiedFranceNov 2, 2022
sicotec.chNot identifiedSwitzerlandNov 2, 2022
st-ji.comManufacturingNot identifiedNov 2, 2022
subcarnechevarria.comManufacturingNot identifiedNov 2, 2022
thehurstgroup.co.ukNot identifiedUnited KingdomNov 2, 2022
wickershamconstruction.comConstructionNot identifiedNov 2, 2022

Showing the 20 most recent of 39. Browse recent data breaches for more.

LV leak sites

Addresses we've seen LV publish victims from. Any .onion address needs the Tor Browser.

  • rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion
  • alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion

LV questions

Is LV still active?

Not for over a year. The last victim we recorded was November 29, 2022. The leak site has published nothing since, though the data it already leaked is still out there.

How many victims has LV claimed?

LV has named 39 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did LV first appear?

The first victim we recorded for LV was posted on May 1, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does LV target?

Manufacturing accounts for the most victims we can classify, with 7. Financial Services follows at 2. We could identify a sector for 15 of 39 victims, so treat this as the shape of the targeting rather than a full census.

Has LV already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.