Metaencryptor

Active
69 victims named on the leak site
19 in the last 30 days
23 in the last 12 months
May 2023 first victim we recorded
Sep 28, 2026 most recent victim posted
2 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

21.7% of Metaencryptor victims whose domain we can identify (15 of 69) had employee credentials leak in the 12 months before Metaencryptor named them as a victim.

We don't know whether any of these credentials were how Metaencryptor gained initial access.

What industries Metaencryptor targets

Sector identified for 48 of 69 victims.

Manufacturing19
Healthcare5
Financial Services4
Automotive4
Logistics3
Media3
Education3
Construction2

Where the victims are located

Country identified for 40 of 69 victims.

United States17
Germany8
United Kingdom3
Japan3
South Korea2
Italy2
Belgium2
Canada2

Most recent Metaencryptor victims

VictimSectorCountryPosted
Aquamar aquamarseafood.comNot identifiedUnited StatesSep 28, 2026
Astemo astemo.comManufacturingJapanSep 28, 2026
Bruker bruker.comManufacturingUnited StatesSep 28, 2026
GE Vernova gevernova.comEnergyUnited StatesSep 28, 2026
PKF Hadiwinata pkfhadiwinata.comFinancial ServicesIndonesiaSep 28, 2026
Platinum Healthcare Staffing platinumhealthcarestaffing.comHealthcareUnited StatesSep 28, 2026
Flex flex.comManufacturingUnited StatesSep 22, 2026
Hudson MD Group hudsonmdgroup.comHealthcareUnited StatesSep 22, 2026
HyVision System hyvision.co.krManufacturingSouth KoreaSep 22, 2026
Visual Intelligence visualintelligenceinc.comTechnologyUnited StatesSep 22, 2026
AECOM aecom.comNot identifiedUnited StatesSep 18, 2026
Beckman Coulter beckmancoulter.comManufacturingUnited StatesSep 18, 2026
Promantra promantra.usHealthcareUnited StatesSep 18, 2026
Nippon Steel nipponsteel.comManufacturingJapanSep 16, 2026
SFA Engineering sfa.co.krManufacturingSouth KoreaSep 16, 2026
EllisDon ellisdon.comConstructionNot identifiedSep 8, 2026
Hologic hologic.comHealthcareUnited StatesSep 8, 2026
SIFCO Industries sifco.comManufacturingUnited StatesSep 8, 2026
Singapore Technologies Engineering stengg.comNot identifiedNot identifiedSep 8, 2026
Factory Five Racing factoryfive.comManufacturingUnited StatesAug 24, 2026

Showing the 20 most recent of 69. Browse recent data breaches for more.

Metaencryptor leak sites

Addresses we've seen Metaencryptor publish victims from. Any .onion address needs the Tor Browser.

  • metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onion
  • metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion

Metaencryptor questions

Is Metaencryptor still active?

Yes. Metaencryptor posted its most recent victim on September 28, 2026. That's 19 victims in the last 30 days.

How many victims has Metaencryptor claimed?

Metaencryptor has named 69 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 23 of them were posted in the last 12 months.

When did Metaencryptor first appear?

The first victim we recorded for Metaencryptor was posted on May 8, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Metaencryptor target?

Manufacturing accounts for the most victims we can classify, with 19. Healthcare follows at 5. We could identify a sector for 48 of 69 victims, so treat this as the shape of the targeting rather than a full census.

Has Metaencryptor already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.