M3RX
Data as of August 16, 2026.
Credential exposure before the attack
5.7% of M3RX victims whose domain we can identify (2 of 35) had employee credentials leak in the 12 months before M3RX named them as a victim.
We don't know whether any of these credentials were how M3RX gained initial access.
What industries M3RX targets
Sector identified for 27 of 35 victims.
| Technology | 5 | |
| Manufacturing | 5 | |
| Automotive | 3 | |
| Logistics | 3 | |
| Non-profit | 2 | |
| Construction | 2 | |
| Healthcare | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 34 of 35 victims.
| United States | 9 | |
| Canada | 4 | |
| United Kingdom | 4 | |
| Australia | 3 | |
| Italy | 2 | |
| Germany | 2 | |
| Mexico | 2 | |
| Switzerland | 1 |
Most recent M3RX victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| AusProof ausproof.com.au | Manufacturing | Australia | Jul 27, 2026 |
| CreateInfor createinfor.pt | Not identified | Portugal | Jul 27, 2026 |
| VHS Hydraulic Components hydraulic-components.net | Manufacturing | United Kingdom | Jul 27, 2026 |
| Premier Mechanical Services servicebypremier.com | Not identified | United States | Jul 27, 2026 |
| UB Freight ubfreight.com | Logistics | New Zealand | Jul 23, 2026 |
| Arambol arambol.co.uk | Not identified | United Kingdom | Jul 20, 2026 |
| Eclective eclective.ie | Hospitality | Ireland | Jul 13, 2026 |
| FORECON foreconinc.com | Real Estate | United States | Jul 13, 2026 |
| WRT World Enterprises wrtworld.com | Logistics | United States | Jul 13, 2026 |
| FasadeConsult Aluminium fasadeconsult.no | Manufacturing | Norway | Jun 12, 2026 |
| HB Experts-Conseils hbexperts-conseils.ca | Not identified | Canada | Jun 12, 2026 |
| KT Group ktwhs.com | Logistics | Canada | Jun 12, 2026 |
| Marin Goodman maringoodman.com | Legal | United States | Jun 12, 2026 |
| SuppCenter Global Services suppcentersa.com | Technology | Not identified | Jun 12, 2026 |
| W.S. Werkstoff Service werkstoff-service.de | Not identified | Germany | Jun 12, 2026 |
| Jichasa jichasa.com | Construction | Mexico | May 28, 2026 |
| Recambios Generales del Automóvil Dosocho dosocho.es | Automotive | Spain | May 18, 2026 |
| Grupo 55 grupo55.com | Construction | Mexico | May 18, 2026 |
| Società Produttori Sementi psbsementi.it | Agriculture | Italy | May 18, 2026 |
| SOFT soft-inc.com | Technology | United States | May 18, 2026 |
Showing the 20 most recent of 35. Browse recent data breaches for more.
M3RX leak site
The address we've seen M3RX publish victims from. Any .onion address needs the Tor Browser.
4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onion
M3RX questions
Is M3RX still active?
Yes. M3RX posted its most recent victim on July 27, 2026. That's 6 victims in the last 30 days.
How many victims has M3RX claimed?
M3RX has named 35 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did M3RX first appear?
The first victim we recorded for M3RX was posted on April 27, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does M3RX target?
Technology accounts for the most victims we can classify, with 5. Manufacturing follows at 5. We could identify a sector for 27 of 35 victims, so treat this as the shape of the targeting rather than a full census.
Has M3RX already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.