Nokoyawa
Data as of August 16, 2026.
Credential exposure before the attack
18.4% of Nokoyawa victims whose domain we can identify (7 of 38) had employee credentials leak in the 12 months before Nokoyawa named them as a victim.
We don't know whether any of these credentials were how Nokoyawa gained initial access.
What industries Nokoyawa targets
Sector identified for 20 of 38 victims.
| Healthcare | 8 | |
| Education | 4 | |
| Manufacturing | 2 | |
| Financial Services | 1 | |
| Technology | 1 | |
| Automotive | 1 | |
| Construction | 1 | |
| Logistics | 1 |
Where the victims are located
Country identified for 11 of 38 victims.
| United Kingdom | 3 | |
| Australia | 2 | |
| Germany | 2 | |
| Canada | 1 | |
| France | 1 | |
| Philippines | 1 | |
| Brazil | 1 |
Most recent Nokoyawa victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Studio Domaine studiodomaine.com | Not identified | Not identified | Aug 7, 2023 |
| Roman Catholic Diocese of Albany rcda.org | Not identified | Not identified | Aug 4, 2023 |
| Pea River peariver.com | Energy | Not identified | Aug 2, 2023 |
| AT&S atssh.com | Not identified | Not identified | Jul 31, 2023 |
| Con-Struct canaropa.com | Manufacturing | Not identified | Jul 31, 2023 |
| Muncy Homes muncyhomes.com | Not identified | Not identified | Jul 31, 2023 |
| onehealthsolutions.com | Healthcare | Not identified | Jul 31, 2023 |
| twv-staderland.de | Not identified | Germany | Jul 31, 2023 |
| Village Church of Barrington vcbweb.org | Not identified | Not identified | Jul 31, 2023 |
| Modern Eyez visionsource-moderneyez.com | Not identified | Not identified | Jul 31, 2023 |
| visionsource-moderneyez.com | Not identified | Not identified | Jul 31, 2023 |
| Accurate Auto accurateautoins.com | Financial Services | Not identified | Jul 21, 2023 |
| canaropa.com | Manufacturing | Not identified | Jul 21, 2023 |
| Chattanooga State Community College chattanoogastate.edu | Education | Not identified | Jul 21, 2023 |
| Canadian Nurses Association cna-aiic.ca | Healthcare | Canada | Jul 21, 2023 |
| Community of Communes comcom-sgc.fr | Not identified | France | Jul 21, 2023 |
| Conex conex-systems.uk | Technology | United Kingdom | Jul 21, 2023 |
| ePerformax eperformax.com | Not identified | Not identified | Jul 21, 2023 |
| Fresca Group frescagroup.co.uk | Not identified | United Kingdom | Jul 21, 2023 |
| gaston.edu | Education | Not identified | Jul 21, 2023 |
Showing the 20 most recent of 38. Browse recent data breaches for more.
Nokoyawa leak sites
Addresses we've seen Nokoyawa publish victims from. Any .onion address needs the Tor Browser.
nokoleakb76znymx443veg4n6fytx6spck6pc7nkr4dvfuygpub6jsid.onioncanarodqqttgf2ofv7rkj74jvani7f2ftrbkmuw7zwyydlxikazimyqd.onionanonfiles.comlirncvjfmdhv6samxvvlohfqx7jklfxoxj7xn3fh7qeabs3taemdsdqd.onion6yofnrq7evqrtz3tzi3dkbrdovtywd35lx3iqbc5dyh367nrdh4jgfyd.onionmega.nz
Nokoyawa questions
Is Nokoyawa still active?
Not for over a year. The last victim we recorded was August 7, 2023. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Nokoyawa claimed?
Nokoyawa has named 38 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Nokoyawa first appear?
The first victim we recorded for Nokoyawa was posted on July 21, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Nokoyawa target?
Healthcare accounts for the most victims we can classify, with 8. Education follows at 4. We could identify a sector for 20 of 38 victims, so treat this as the shape of the targeting rather than a full census.
Has Nokoyawa already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.