M3RX

Active
44 victims named on the leak site
7 in the last 30 days
44 in the last 12 months
Apr 2026 first victim we recorded
Sep 30, 2026 most recent victim posted
1 leak site tracked

Data as of October 1, 2026.

Credential exposure before the attack

4.5% of M3RX victims whose domain we can identify (2 of 44) had employee credentials leak in the 12 months before M3RX named them as a victim.

We don't know whether any of these credentials were how M3RX gained initial access.

What industries M3RX targets

Sector identified for 35 of 44 victims.

Technology8
Manufacturing6
Automotive3
Construction3
Logistics3
Non-profit2
Financial Services2
Legal2

Where the victims are located

Country identified for 42 of 44 victims.

United States13
Canada4
United Kingdom4
Australia3
Germany3
Italy2
Spain2
Mexico2

Most recent M3RX victims

VictimSectorCountryPosted
Chouhan cpacb.comFinancial ServicesUnited StatesSep 30, 2026
Interconnect Computer Cabling Services iccsi.comTelecommunicationsUnited StatesSep 30, 2026
Intense Group intense.plNot identifiedPolandSep 30, 2026
Noon Sugar Mills noonsugar.comManufacturingNot identifiedSep 30, 2026
Otero Geeza Law oterolaw.comLegalUnited StatesSep 30, 2026
Soma Soluções somasolucoes.comTechnologyBrazilSep 30, 2026
Cipher Systems cipher.systemsTechnologyUnited StatesSep 28, 2026
Lindner Group lindner-group.comConstructionGermanyAug 31, 2026
Tecnoabi tecnoabi.comTechnologySpainAug 17, 2026
AusProof ausproof.com.auManufacturingAustraliaJul 27, 2026
CreateInfor createinfor.ptNot identifiedPortugalJul 27, 2026
VHS Hydraulic Components hydraulic-components.netManufacturingUnited KingdomJul 27, 2026
Premier Mechanical Services servicebypremier.comNot identifiedUnited StatesJul 27, 2026
UB Freight ubfreight.comLogisticsNew ZealandJul 23, 2026
Arambol arambol.co.ukNot identifiedUnited KingdomJul 20, 2026
Eclective eclective.ieHospitalityIrelandJul 13, 2026
FORECON foreconinc.comReal EstateUnited StatesJul 13, 2026
WRT World Enterprises wrtworld.comLogisticsUnited StatesJul 13, 2026
FasadeConsult Aluminium fasadeconsult.noManufacturingNorwayJun 12, 2026
HB Experts-Conseils hbexperts-conseils.caNot identifiedCanadaJun 12, 2026

Showing the 20 most recent of 44. Browse recent data breaches for more.

M3RX leak site

The address we've seen M3RX publish victims from. Any .onion address needs the Tor Browser.

  • 4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onion

M3RX questions

Is M3RX still active?

Yes. M3RX posted its most recent victim on September 30, 2026. That's 7 victims in the last 30 days.

How many victims has M3RX claimed?

M3RX has named 44 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did M3RX first appear?

The first victim we recorded for M3RX was posted on April 27, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does M3RX target?

Technology accounts for the most victims we can classify, with 8. Manufacturing follows at 6. We could identify a sector for 35 of 44 victims, so treat this as the shape of the targeting rather than a full census.

Has M3RX already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.