NightSpire
Data as of September 14, 2026.
Credential exposure before the attack
13.3% of NightSpire victims whose domain we can identify (33 of 248) had employee credentials leak in the 12 months before NightSpire named them as a victim.
We don't know whether any of these credentials were how NightSpire gained initial access.
What industries NightSpire targets
Sector identified for 182 of 248 victims.
| Manufacturing | 46 | |
| Healthcare | 21 | |
| Financial Services | 16 | |
| Technology | 16 | |
| Construction | 13 | |
| Logistics | 12 | |
| Legal | 11 | |
| Hospitality | 9 |
Where the victims are located
Country identified for 202 of 248 victims.
| United States | 67 | |
| India | 14 | |
| Turkey | 10 | |
| France | 8 | |
| Japan | 7 | |
| Brazil | 7 | |
| Italy | 7 | |
| Spain | 6 |
Most recent NightSpire victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Diamondlease diamondlease.com | Logistics | United Arab Emirates | Sep 14, 2026 |
| Özel & Özel Attorneys at Law ozel.av.tr | Legal | Turkey | Sep 14, 2026 |
| Perimetral Oriental de Bogotá S.A.S. pob.com.co | Not identified | Colombia | Sep 14, 2026 |
| Tuboaços da Amazônia tuboacos.com.br | Not identified | Brazil | Sep 14, 2026 |
| Transportes Montejo transportesmontejo.com | Logistics | Colombia | Sep 2, 2026 |
| Easyoga easyoga.com | Not identified | Taiwan | Sep 1, 2026 |
| Truckworx truckworx.com | Not identified | United States | Sep 1, 2026 |
| Victory Personal Care weebly.com | Not identified | United States | Aug 22, 2026 |
| Akribis Systems akribis-sys.com | Manufacturing | Not identified | Jul 28, 2026 |
| K. Venkatesh cavenkatesh.com | Financial Services | India | Jul 28, 2026 |
| Diffusion de Produits Inoxydables dpinox.fr | Manufacturing | France | Jul 28, 2026 |
| Furama Hotels International furama.com | Hospitality | Singapore | Jul 28, 2026 |
| KSL Dirtworks ksldirtworks.com | Government | United States | Jul 28, 2026 |
| MKS Transformator mksltd.net | Manufacturing | Turkey | Jul 28, 2026 |
| Kates Nussman Ellis Earle & Landolfi nklaw.com | Legal | United States | Jul 28, 2026 |
| Optidea optidea.ch | Not identified | Switzerland | Jul 28, 2026 |
| TFG Benefits tfgbenefits.com | Financial Services | United States | Jul 28, 2026 |
| Thai Seng International thaiseng.co.th | Construction | Thailand | Jul 28, 2026 |
| The Mountain themountaincompany.co.uk | Not identified | United Kingdom | Jul 28, 2026 |
| Wings Projects wingsprojects.com | Hospitality | India | Jul 28, 2026 |
Showing the 20 most recent of 248. Browse recent data breaches for more.
NightSpire leak sites
Addresses we've seen NightSpire publish victims from. Any .onion address needs the Tor Browser.
nspire5jh3xgnngarp42reou4lxrawbkap5yplaxqiroa24awjirynyd.onionnspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onionnspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onionnspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.oniona2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onionnspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.oniontezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onionakiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
NightSpire questions
Is NightSpire still active?
Yes. NightSpire posted its most recent victim on September 14, 2026. That's 8 victims in the last 30 days.
How many victims has NightSpire claimed?
NightSpire has named 248 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 178 of them were posted in the last 12 months.
When did NightSpire first appear?
The first victim we recorded for NightSpire was posted on January 2, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does NightSpire target?
Manufacturing accounts for the most victims we can classify, with 46. Healthcare follows at 21. We could identify a sector for 182 of 248 victims, so treat this as the shape of the targeting rather than a full census.
Has NightSpire already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.