Metaencryptor
Data as of August 16, 2026.
Credential exposure before the attack
16.7% of Metaencryptor victims whose domain we can identify (8 of 48) had employee credentials leak in the 12 months before Metaencryptor named them as a victim.
We don't know whether any of these credentials were how Metaencryptor gained initial access.
What industries Metaencryptor targets
Sector identified for 31 of 48 victims.
| Manufacturing | 10 | |
| Automotive | 4 | |
| Education | 3 | |
| Media | 3 | |
| Logistics | 3 | |
| Financial Services | 3 | |
| Healthcare | 1 | |
| Real Estate | 1 |
Where the victims are located
Country identified for 22 of 48 victims.
| Germany | 8 | |
| United States | 4 | |
| United Kingdom | 3 | |
| Italy | 2 | |
| Belgium | 2 | |
| Canada | 2 | |
| Japan | 1 |
Most recent Metaencryptor victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Corona corona.co.jp | Manufacturing | Japan | Jul 9, 2026 |
| MPA Pharma mpapharma.com | Healthcare | United Kingdom | Mar 4, 2026 |
| Weber Water Resources weberwaterresources.com | Not identified | United States | Oct 31, 2025 |
| Trailer Transit trailertransit.com | Not identified | United States | Sep 16, 2025 |
| Woodlore International woodlore.ca | Manufacturing | United States | Aug 26, 2025 |
| The Lowell Hotel lowellhotel.com | Hospitality | United States | Jun 25, 2025 |
| Groupe Devimco devimco.com | Real Estate | Not identified | Jun 5, 2025 |
| Third Avenue Management thirdave.com | Financial Services | Not identified | Apr 10, 2025 |
| Lee Hartman & Sons leehartman.com | Not identified | Not identified | Jan 28, 2025 |
| Webasto webasto.com | Automotive | Not identified | Aug 28, 2024 |
| Life University life.edu | Education | Not identified | Aug 23, 2024 |
| Saeilo saeilo.com | Manufacturing | Not identified | Aug 23, 2024 |
| MBS Radio mbsradio.com | Media | Not identified | Aug 16, 2024 |
| Carlex carlex.com | Automotive | Not identified | Aug 1, 2024 |
| Seoul Semiconductor seoulsemicon.com | Manufacturing | Not identified | Jul 18, 2024 |
| Belzona belzona.co.uk | Manufacturing | United Kingdom | Jul 18, 2024 |
| BOB Automotive Group bob-automotive.com | Automotive | Not identified | Jul 18, 2024 |
| Coswell coswell.biz | Not identified | Italy | Jul 18, 2024 |
| CVO Antwerpen cvoantwerpen.be | Education | Belgium | Jul 18, 2024 |
| Epicure epicure.com | Not identified | Not identified | Jul 18, 2024 |
Showing the 20 most recent of 48. Browse recent data breaches for more.
Metaencryptor leak site
The address we've seen Metaencryptor publish victims from. Any .onion address needs the Tor Browser.
metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onion
Metaencryptor questions
Is Metaencryptor still active?
Yes. Metaencryptor posted its most recent victim on July 9, 2026.
How many victims has Metaencryptor claimed?
Metaencryptor has named 48 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 5 of them were posted in the last 12 months.
When did Metaencryptor first appear?
The first victim we recorded for Metaencryptor was posted on May 8, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Metaencryptor target?
Manufacturing accounts for the most victims we can classify, with 10. Automotive follows at 4. We could identify a sector for 31 of 48 victims, so treat this as the shape of the targeting rather than a full census.
Has Metaencryptor already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.