NightSpire
Data as of August 16, 2026.
Credential exposure before the attack
12.1% of NightSpire victims whose domain we can identify (29 of 240) had employee credentials leak in the 12 months before NightSpire named them as a victim.
We don't know whether any of these credentials were how NightSpire gained initial access.
What industries NightSpire targets
Sector identified for 179 of 240 victims.
| Manufacturing | 46 | |
| Healthcare | 21 | |
| Financial Services | 16 | |
| Technology | 16 | |
| Construction | 13 | |
| Logistics | 10 | |
| Legal | 10 | |
| Hospitality | 9 |
Where the victims are located
Country identified for 194 of 240 victims.
| United States | 65 | |
| India | 14 | |
| Turkey | 9 | |
| France | 8 | |
| Japan | 7 | |
| Italy | 7 | |
| United Kingdom | 6 | |
| Spain | 6 |
Most recent NightSpire victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Akribis Systems akribis-sys.com | Manufacturing | Not identified | Jul 28, 2026 |
| K. Venkatesh cavenkatesh.com | Financial Services | India | Jul 28, 2026 |
| Diffusion de Produits Inoxydables dpinox.fr | Manufacturing | France | Jul 28, 2026 |
| Furama Hotels International furama.com | Hospitality | Singapore | Jul 28, 2026 |
| KSL Dirtworks ksldirtworks.com | Government | United States | Jul 28, 2026 |
| MKS Transformator mksltd.net | Manufacturing | Turkey | Jul 28, 2026 |
| Kates Nussman Ellis Earle & Landolfi nklaw.com | Legal | United States | Jul 28, 2026 |
| Optidea optidea.ch | Not identified | Switzerland | Jul 28, 2026 |
| TFG Benefits tfgbenefits.com | Financial Services | United States | Jul 28, 2026 |
| Thai Seng International thaiseng.co.th | Construction | Thailand | Jul 28, 2026 |
| The Mountain themountaincompany.co.uk | Not identified | United Kingdom | Jul 28, 2026 |
| Wings Projects wingsprojects.com | Hospitality | India | Jul 28, 2026 |
| Auto Royal autoroyalcompany.it | Automotive | Italy | Jul 24, 2026 |
| Cedar Crest College cedarcrest.edu | Education | United States | Jul 15, 2026 |
| Webosphere webosphere.in | Technology | India | Jul 14, 2026 |
| Grupo Riquelme gruporiquelme.com | Manufacturing | Not identified | Jun 26, 2026 |
| Artistic Smiles artisticsmiles.org | Healthcare | United States | Jun 22, 2026 |
| Dr. Jack Haney drjackhaney.com | Healthcare | United States | Jun 19, 2026 |
| Legendary Home Services legendsmn.com | Not identified | United States | Jun 19, 2026 |
| El Gouna elgouna.com | Hospitality | Egypt | Jun 16, 2026 |
Showing the 20 most recent of 240. Browse recent data breaches for more.
NightSpire leak sites
Addresses we've seen NightSpire publish victims from. Any .onion address needs the Tor Browser.
nspire5jh3xgnngarp42reou4lxrawbkap5yplaxqiroa24awjirynyd.onionnspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onionnspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onionnspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.oniona2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onionnspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.oniontezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
NightSpire questions
Is NightSpire still active?
Yes. NightSpire posted its most recent victim on July 28, 2026. That's 13 victims in the last 30 days.
How many victims has NightSpire claimed?
NightSpire has named 240 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 170 of them were posted in the last 12 months.
When did NightSpire first appear?
The first victim we recorded for NightSpire was posted on January 2, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does NightSpire target?
Manufacturing accounts for the most victims we can classify, with 46. Healthcare follows at 21. We could identify a sector for 179 of 240 victims, so treat this as the shape of the targeting rather than a full census.
Has NightSpire already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.