MORPHEUS
Data as of August 16, 2026.
Credential exposure before the attack
43.2% of MORPHEUS victims whose domain we can identify (16 of 37) had employee credentials leak in the 12 months before MORPHEUS named them as a victim.
We don't know whether any of these credentials were how MORPHEUS gained initial access.
What industries MORPHEUS targets
Sector identified for 29 of 37 victims.
| Manufacturing | 9 | |
| Healthcare | 8 | |
| Financial Services | 4 | |
| Legal | 3 | |
| Technology | 2 | |
| Construction | 2 | |
| Hospitality | 1 |
Where the victims are located
Country identified for 19 of 37 victims.
| Germany | 5 | |
| India | 3 | |
| United States | 3 | |
| Mexico | 2 | |
| Belgium | 1 | |
| South Korea | 1 | |
| Denmark | 1 | |
| Singapore | 1 |
Most recent MORPHEUS victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Yue Ki Industrial yueki.com.tw | Manufacturing | Taiwan | Jul 31, 2026 |
| Argonaut Manufacturing Services argonautms.com | Manufacturing | United States | Jul 22, 2026 |
| Kyowa Singapore kyowasingapore.com | Manufacturing | Singapore | Jul 22, 2026 |
| Hansa Research hansaresearch.com | Not identified | India | Jul 7, 2026 |
| Delegal & Poindexter protectingcareers.com | Legal | United States | Jun 25, 2026 |
| HDFC Mutual Fund hdfcfund.com | Financial Services | India | Jun 10, 2026 |
| 3i Infotech 3i-infotech.com | Technology | India | Jun 9, 2026 |
| Baytech baytech.dk | Manufacturing | Denmark | May 15, 2026 |
| GGIP Insurance ggipinsurance.com | Financial Services | Not identified | Apr 22, 2026 |
| GGI Tokio Marine ggitokiomarine.com | Financial Services | Not identified | Apr 22, 2026 |
| SBC Tanzania sbctanzania.co.tz | Not identified | Not identified | Mar 31, 2026 |
| Surtech surtechinc.kr | Manufacturing | South Korea | Mar 23, 2026 |
| Sunset World Resort sunsetworldresorts.com | Hospitality | Mexico | Jan 29, 2026 |
| Valle Redondo valleredondo.com.mx | Manufacturing | Mexico | Dec 29, 2025 |
| Scipioni scipioni.be | Healthcare | Belgium | Dec 23, 2025 |
| TeamGlobal teamglobal.com | Manufacturing | United States | Nov 21, 2025 |
| Landmark Properties landmarkproperties.com | Financial Services | Not identified | May 21, 2025 |
| Metal Sales metalsales.us.com | Manufacturing | Not identified | Apr 8, 2025 |
| Latronica Law Firm latronicalaw.com | Legal | Not identified | Apr 7, 2025 |
| Acella Pharmaceuticals acellapharma.com | Healthcare | Not identified | Apr 2, 2025 |
Showing the 20 most recent of 37. Browse recent data breaches for more.
MORPHEUS leak sites
Addresses we've seen MORPHEUS publish victims from. Any .onion address needs the Tor Browser.
izsp6ipui4ctgxfugbgtu65kzefrucltyfpbxplmfybl5swiadpljmyd.onionhptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion
MORPHEUS questions
Is MORPHEUS still active?
Yes. MORPHEUS posted its most recent victim on July 31, 2026. That's 3 victims in the last 30 days.
How many victims has MORPHEUS claimed?
MORPHEUS has named 37 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 16 of them were posted in the last 12 months.
When did MORPHEUS first appear?
The first victim we recorded for MORPHEUS was posted on January 8, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does MORPHEUS target?
Manufacturing accounts for the most victims we can classify, with 9. Healthcare follows at 8. We could identify a sector for 29 of 37 victims, so treat this as the shape of the targeting rather than a full census.
Has MORPHEUS already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.