Nitrogen
Data as of August 16, 2026.
Credential exposure before the attack
53.2% of Nitrogen victims whose domain we can identify (25 of 47) had employee credentials leak in the 12 months before Nitrogen named them as a victim.
We don't know whether any of these credentials were how Nitrogen gained initial access.
What industries Nitrogen targets
Sector identified for 31 of 47 victims.
| Manufacturing | 12 | |
| Automotive | 3 | |
| Hospitality | 3 | |
| Construction | 2 | |
| Education | 2 | |
| Technology | 2 | |
| Government | 2 | |
| Healthcare | 1 |
Where the victims are located
Country identified for 25 of 47 victims.
| United States | 13 | |
| Canada | 4 | |
| France | 2 | |
| Portugal | 2 | |
| Belgium | 1 | |
| Taiwan | 1 | |
| Italy | 1 | |
| Germany | 1 |
Most recent Nitrogen victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Pyramid Management Group pyramidmg.com | Real Estate | United States | Jun 4, 2026 |
| Hon Hai Precision Industry foxconn.com | Manufacturing | Taiwan | May 12, 2026 |
| Enensys Technologies enensys.com | Telecommunications | France | Mar 20, 2026 |
| De Walch and Partners dewalch.com | Legal | Belgium | Feb 19, 2026 |
| PC CarX pccarx.com | Education | United States | Feb 11, 2026 |
| Lumio Dental lumiodental.com | Healthcare | United States | Feb 6, 2026 |
| Connor connorco.com | Manufacturing | United States | Jan 28, 2026 |
| QualiChem Metalworking Fluids qualichem.com | Manufacturing | United States | Jan 28, 2026 |
| Dura Shiloh durashiloh.com | Manufacturing | United States | Jan 20, 2026 |
| Whitfield Welding whitfieldwelding.com | Manufacturing | United States | Jan 20, 2026 |
| Walters Group Inc waltersgroupinc.com | Construction | Canada | Dec 17, 2025 |
| AvtechTyee avtechtyee.com | Manufacturing | United States | Dec 6, 2025 |
| Black Hills Bentonite bhbentonite.com | Manufacturing | United States | Nov 7, 2025 |
| Phillips Printing philprint.com | Not identified | United States | Oct 30, 2025 |
| Heffner Lexus Toyota heffner.ca | Automotive | Canada | Sep 15, 2025 |
| Ocean Edge Resort & Golf Club oceanedge.com | Hospitality | United States | Aug 21, 2025 |
| F&P Georgia fandpgeorgia.com | Automotive | United States | Aug 7, 2025 |
| Palm Bay International palmbay.com | Not identified | Not identified | Jul 24, 2025 |
| The C3 Group c3group.com | Manufacturing | Not identified | Jul 17, 2025 |
| Progressive Auto Group progressiveautogroup.com | Automotive | Not identified | Jul 16, 2025 |
Showing the 20 most recent of 47. Browse recent data breaches for more.
Nitrogen leak sites
Addresses we've seen Nitrogen publish victims from. Any .onion address needs the Tor Browser.
nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onionyqiaekirp7n7fkp3bwx2nfxm6zohhaa3ct5xvdqsxsanxqqwoyltb6id.onion6lrsxvqscxtznb4fhux5u3vbslbanxjzxzgtokjtfwaitxe4pfgfebad.onionz4tonbkjybcllsvd45smpkqkk5uaspmlnvmysrkxt37wuudijvp7k2id.onionsqnnhgqr4iiwnkaih6vspyxmebz2vvjv3uybmjdynw6sne5plilunhyd.onionawrfq7pjydfp3hwbsun6ltxrrzths5ztgxj7i7ybx7twjrdvzvxkgwad.onion2u6njk55okdxvrup5feu3wbhyxvlqla7yuj2oz3xkzz27yzc66vcirqd.oniony6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onion6blfnoe24tfpal2kmacphkjmzph3oghjdznsgkf23lmvjqbtgrmedpid.onion2idvzxbwvzbxhuniw7kfaimcvtqazmn7nmuw7codg65cshwwsvnpz7id.onionbxi2cepk57dy3uhgwqd6dri6jtuqe7btay225rn6xkvvgnp2cvjvowqd.onionnxarphaf35qp2uuosaq54m3a2s5kt4svpcv56mvz6r7xy6na7uo5ypyd.onion
Nitrogen questions
Is Nitrogen still active?
Yes. Nitrogen posted its most recent victim on June 4, 2026.
How many victims has Nitrogen claimed?
Nitrogen has named 47 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 16 of them were posted in the last 12 months.
When did Nitrogen first appear?
The first victim we recorded for Nitrogen was posted on October 2, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Nitrogen target?
Manufacturing accounts for the most victims we can classify, with 12. Automotive follows at 3. We could identify a sector for 31 of 47 victims, so treat this as the shape of the targeting rather than a full census.
Has Nitrogen already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.