Metaencryptor
Data as of September 14, 2026.
Credential exposure before the attack
22.6% of Metaencryptor victims whose domain we can identify (12 of 53) had employee credentials leak in the 12 months before Metaencryptor named them as a victim.
We don't know whether any of these credentials were how Metaencryptor gained initial access.
What industries Metaencryptor targets
Sector identified for 35 of 53 victims.
| Manufacturing | 12 | |
| Automotive | 4 | |
| Media | 3 | |
| Education | 3 | |
| Financial Services | 3 | |
| Logistics | 3 | |
| Construction | 2 | |
| Healthcare | 2 |
Where the victims are located
Country identified for 25 of 53 victims.
| Germany | 8 | |
| United States | 7 | |
| United Kingdom | 3 | |
| Italy | 2 | |
| Belgium | 2 | |
| Canada | 2 | |
| Japan | 1 |
Most recent Metaencryptor victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| EllisDon ellisdon.com | Construction | Not identified | Sep 8, 2026 |
| Hologic hologic.com | Healthcare | United States | Sep 8, 2026 |
| SIFCO Industries sifco.com | Manufacturing | United States | Sep 8, 2026 |
| Singapore Technologies Engineering stengg.com | Not identified | Not identified | Sep 8, 2026 |
| Factory Five Racing factoryfive.com | Manufacturing | United States | Aug 24, 2026 |
| Corona corona.co.jp | Manufacturing | Japan | Jul 9, 2026 |
| MPA Pharma mpapharma.com | Healthcare | United Kingdom | Mar 4, 2026 |
| Weber Water Resources weberwaterresources.com | Not identified | United States | Oct 31, 2025 |
| Trailer Transit trailertransit.com | Not identified | United States | Sep 16, 2025 |
| Woodlore International woodlore.ca | Manufacturing | United States | Aug 26, 2025 |
| The Lowell Hotel lowellhotel.com | Hospitality | United States | Jun 25, 2025 |
| Groupe Devimco devimco.com | Real Estate | Not identified | Jun 5, 2025 |
| Third Avenue Management thirdave.com | Financial Services | Not identified | Apr 10, 2025 |
| Lee Hartman & Sons leehartman.com | Not identified | Not identified | Jan 28, 2025 |
| Webasto webasto.com | Automotive | Not identified | Aug 28, 2024 |
| Life University life.edu | Education | Not identified | Aug 23, 2024 |
| Saeilo saeilo.com | Manufacturing | Not identified | Aug 23, 2024 |
| MBS Radio mbsradio.com | Media | Not identified | Aug 16, 2024 |
| Carlex carlex.com | Automotive | Not identified | Aug 1, 2024 |
| Seoul Semiconductor seoulsemicon.com | Manufacturing | Not identified | Jul 18, 2024 |
Showing the 20 most recent of 53. Browse recent data breaches for more.
Metaencryptor leak sites
Addresses we've seen Metaencryptor publish victims from. Any .onion address needs the Tor Browser.
metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onionmetacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion
Metaencryptor questions
Is Metaencryptor still active?
Yes. Metaencryptor posted its most recent victim on September 8, 2026. That's 5 victims in the last 30 days.
How many victims has Metaencryptor claimed?
Metaencryptor has named 53 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 9 of them were posted in the last 12 months.
When did Metaencryptor first appear?
The first victim we recorded for Metaencryptor was posted on May 8, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Metaencryptor target?
Manufacturing accounts for the most victims we can classify, with 12. Automotive follows at 4. We could identify a sector for 35 of 53 victims, so treat this as the shape of the targeting rather than a full census.
Has Metaencryptor already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.