MoneyMessage
Data as of October 1, 2026.
Credential exposure before the attack
22.5% of MoneyMessage victims whose domain we can identify (9 of 40) had employee credentials leak in the 12 months before MoneyMessage named them as a victim.
We don't know whether any of these credentials were how MoneyMessage gained initial access.
What industries MoneyMessage targets
Sector identified for 27 of 40 victims.
| Manufacturing | 9 | |
| Healthcare | 5 | |
| Non-profit | 4 | |
| Financial Services | 3 | |
| Logistics | 3 | |
| Legal | 1 | |
| Energy | 1 | |
| Education | 1 |
Where the victims are located
Country identified for 17 of 40 victims.
| United States | 9 | |
| Italy | 2 | |
| Egypt | 2 | |
| Canada | 1 | |
| Turkey | 1 | |
| Argentina | 1 | |
| Australia | 1 |
Most recent MoneyMessage victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| U.S. Electrical Services usesi.com | Manufacturing | United States | Sep 22, 2026 |
| ProCare theprocare.com | Healthcare | United States | Aug 31, 2026 |
| Yourway Transportation yourwayinc.com | Logistics | United States | Jul 27, 2026 |
| Indigo Energy indigoenergy.com | Energy | United States | Jul 24, 2026 |
| Envision Unlimited envisionunlimited.org | Non-profit | United States | Jul 10, 2026 |
| X-Copper xcopper.com | Legal | Canada | Jul 3, 2026 |
| Forestdale forestdaleinc.org | Healthcare | United States | May 1, 2026 |
| First Presbyterian Orange County Foundation fpocf.org | Non-profit | United States | Jan 29, 2026 |
| Bucks County Opportunity Council bcoc.org | Non-profit | United States | Aug 5, 2025 |
| Young Adjustment youngadjustment.com | Not identified | Not identified | Jul 16, 2025 |
| The Tech Interactive thetech.org | Non-profit | Not identified | Apr 21, 2025 |
| Marina Family Medical marinafamilymedical.com.au | Healthcare | Australia | Jan 20, 2025 |
| National Atomic Energy Commission argentina.gob.ar | Not identified | Argentina | Dec 19, 2024 |
| Kazyon kazyonplus.com | Not identified | Egypt | Dec 14, 2024 |
| Egyptian Tax Authority eta.gov.eg | Not identified | Egypt | Nov 18, 2024 |
| Biman Airlines biman-airlines.com | Not identified | Not identified | Oct 9, 2024 |
| Micro Star International msi.com | Manufacturing | Not identified | Oct 9, 2024 |
| PharMerica pharmerica.com | Not identified | Not identified | Oct 9, 2024 |
| First Baptist Medical Center fbmcdallas.com | Healthcare | Not identified | Jun 20, 2024 |
| Tri-Way riellosistemi.it | Manufacturing | Italy | Oct 13, 2023 |
Showing the 20 most recent of 40. Browse recent data breaches for more.
MoneyMessage leak sites
Addresses we've seen MoneyMessage publish victims from. Any .onion address needs the Tor Browser.
blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onionqyk5o7wcgocwebnymjusnc7siyetwl7po26flw4e6hhg2xiue7brvmid.onionmblwasncjkjkzxd3n7ednlnjfvjqoswv54kpn3rpf4jzrn3j24rumcad.onion372bkntomuk4xmevyki2gvpzdsm77xkhp4z6sctugcogqwgpqj4xkjyd.onionp6kxp556kkcbjdjsg24g3edmvr7v7ujecuychw4ibvqhl6wuomnrgbqd.onionz46mj5ihckzwf2ons46ceryjwyxt3ctrqyglmre5uhnipvoepaciulid.onion3w3uuz4vze6wdwxrebn3oaavft47xtvghl7qcmpqclgojr44muaigwyd.onionbolfkdkjbdig64ieqixpyhmquuadkm6nzohutbkfwgzftd35kipy45ad.onionl7eupjzxzfbsw7nxu7wu7lj2lzr5ulmyuyd4neyasbdmvzcedal7mmid.onionbasemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onionxq5t7xwptmpoxzjkns7wfbbr43zxedm6ygbfsh6bp6lipvyhzkfopjyd.onionmd7a4mzsppjuaw4zczoojpo7arqrlnmhlqoo35ttrc7l2lpeiblx2yqd.onionl4wvjhcng4klrah4gldyyvo3x5p5o4frzbvwdhzqa6vkg2chistqj3yd.oniond26nwzgwylb3no3ar3rt3si3e3ujzndhp5wryxxlr76wba5snhap3tyd.onionlhzaw2b2xn6lmtoioiswufyvjnrghlkmhtvwgsrsjnnmj2ceu56popqd.onionwzu6yixpcohxeeunakzqf42dothwikt3gvtovamxdm6rfl3oe6smywyd.onionvkge4tbgo3kfc6n5lgjyvb7abjxp7wdnaumkh6xscyj4dceifieunkad.onionau6l74lej2qvwrvasdyc5ta4g7jdshjwkzbi635g6uztld2n2fcacyad.onion26kbddrpm2xfjg4unow76xyvrffwh4usqjhsqgalf4h3diiujy75ngqd.onionjg7qeqdbqqordr5tazw5zc7s2h4sk2pt2hx4cxycqrcwr7vtpmreshad.onionvycmr2wn5nqhkpla62mqe4vxh4fgdbc5id4g6piy4mvbjnb4mp4t25yd.oniond2vda7sp7rxuizyduwvnvccs3giddkwgglj5ecgrmdpu32grp2txjeqd.onionjioj2j5k53vrhtdgvjmeijgkdxgwadzjacywnybjvqftbkqpt3oy6cid.onionnhdmgcysxuvvmd4dqwqisxumirvcj6xfhahuds5z7qgj7qlr3i73nnqd.onion742srdwxlwiu75kr3sbf6kzwjcxjwezvpi3s76ignhes3vqacvh3e4ad.onion
MoneyMessage questions
Is MoneyMessage still active?
Yes. MoneyMessage posted its most recent victim on September 22, 2026.
How many victims has MoneyMessage claimed?
MoneyMessage has named 40 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 8 of them were posted in the last 12 months.
When did MoneyMessage first appear?
The first victim we recorded for MoneyMessage was posted on January 22, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does MoneyMessage target?
Manufacturing accounts for the most victims we can classify, with 9. Healthcare follows at 5. We could identify a sector for 27 of 40 victims, so treat this as the shape of the targeting rather than a full census.
Has MoneyMessage already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.