Obscura
Data as of August 16, 2026.
Credential exposure before the attack
6.7% of Obscura victims whose domain we can identify (2 of 30) had employee credentials leak in the 12 months before Obscura named them as a victim.
We don't know whether any of these credentials were how Obscura gained initial access.
What industries Obscura targets
Sector identified for 26 of 30 victims.
| Construction | 5 | |
| Government | 4 | |
| Healthcare | 4 | |
| Energy | 2 | |
| Manufacturing | 2 | |
| Retail | 2 | |
| Logistics | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for all 30 victims.
| United States | 8 | |
| Malaysia | 5 | |
| Thailand | 3 | |
| Egypt | 2 | |
| Ireland | 2 | |
| Denmark | 2 | |
| Czech Republic | 1 | |
| Greece | 1 |
Most recent Obscura victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Clever Power cleverpower.eu | Energy | Czech Republic | Jan 12, 2026 |
| REDtone redtone.com | Government | Malaysia | Jan 12, 2026 |
| Revoil revoil.gr | Energy | Greece | Jan 12, 2026 |
| STC Concrete Products stc.co.th | Construction | Thailand | Jan 12, 2026 |
| Thai Pet Food Group thaipet.com | Manufacturing | Thailand | Jan 12, 2026 |
| Trend Import Export trend.ro | Technology | Romania | Jan 12, 2026 |
| ACE Forwarding aceforwarding.com | Logistics | United States | Dec 15, 2025 |
| StanleyCo Malaysia stanleyco.com.my | Financial Services | Malaysia | Dec 15, 2025 |
| Startek startek-eng.com | Not identified | United States | Dec 15, 2025 |
| New Toyo International Holdings newtoyo.com | Not identified | Singapore | Nov 3, 2025 |
| Thompson Dorfman Sweatman tdslaw.com | Legal | Canada | Oct 31, 2025 |
| Federal Auto Holdings Berhad federalauto.com.my | Automotive | Malaysia | Oct 29, 2025 |
| Cape Dara Resort Pattaya capedarapattaya.com | Hospitality | Thailand | Oct 21, 2025 |
| City of Michigan City Indiana michigancityin.gov | Government | United States | Oct 14, 2025 |
| City of Michigan City michigancityin.gov | Government | United States | Oct 13, 2025 |
| EAST Design Architect eastdesign.com.my | Not identified | Malaysia | Sep 29, 2025 |
| Espectral espectral.pt | Telecommunications | Portugal | Sep 29, 2025 |
| Heavenly Dental heavenly-dental.com | Healthcare | United States | Sep 29, 2025 |
| Meamar Group meamargroup.com | Construction | Egypt | Sep 29, 2025 |
| Plaza Dental plazadental.com | Healthcare | United States | Sep 29, 2025 |
Showing the 20 most recent of 30. Browse recent data breaches for more.
Obscura leak site
The address we've seen Obscura publish victims from. Any .onion address needs the Tor Browser.
obscurad3aphckihv7wptdxvdnl5emma6t3vikcf3c5oiiqndq6y6xad.onion
Obscura questions
Is Obscura still active?
It's gone quiet. The last victim we recorded was January 12, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has Obscura claimed?
Obscura has named 30 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Obscura first appear?
The first victim we recorded for Obscura was posted on September 5, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Obscura target?
Construction accounts for the most victims we can classify, with 5. Government follows at 4. We could identify a sector for 26 of 30 victims, so treat this as the shape of the targeting rather than a full census.
Has Obscura already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.