Panzer
Data as of September 15, 2026.
Credential exposure before the attack
8% of Panzer victims whose domain we can identify (2 of 25) had employee credentials leak in the 12 months before Panzer named them as a victim.
We don't know whether any of these credentials were how Panzer gained initial access.
What industries Panzer targets
Sector identified for 18 of 25 victims.
| Manufacturing | 4 | |
| Government | 3 | |
| Education | 3 | |
| Technology | 2 | |
| Construction | 2 | |
| Media | 1 | |
| Hospitality | 1 | |
| Automotive | 1 |
Where the victims are located
Country identified for 23 of 25 victims.
| Spain | 3 | |
| Germany | 3 | |
| Thailand | 2 | |
| Italy | 2 | |
| Indonesia | 2 | |
| Serbia | 2 | |
| Portugal | 2 | |
| Nigeria | 1 |
Most recent Panzer victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| AEMET aemet.es | Not identified | Spain | Sep 14, 2026 |
| Cerámicas Kantu ceramicaskantu.com | Manufacturing | Peru | Sep 14, 2026 |
| Konica Minolta Business Solutions Bulgaria konicaminolta.bg | Technology | Bulgaria | Sep 14, 2026 |
| Aqualogus aqualogus.com | Not identified | Portugal | Sep 10, 2026 |
| Financière d\'Uzès finuzes.fr | Financial Services | France | Sep 9, 2026 |
| Khaled Alfagih Engineering Consultancy kfoco.com | Not identified | Saudi Arabia | Sep 8, 2026 |
| Edacentrum edacentrum.de | Not identified | Germany | Sep 7, 2026 |
| Dinas Komunikasi, Informatika dan Digital Provinsi Jawa Tengah jatengprov.go.id | Government | Indonesia | Sep 4, 2026 |
| Heilbronn University of Applied Sciences hs-heilbronn.de | Education | Germany | Sep 4, 2026 |
| DGEEC medu.pt | Education | Portugal | Aug 31, 2026 |
| Faculty of Mechanical and Civil Engineering in Kraljevo mfkv.rs | Education | Serbia | Aug 25, 2026 |
| Provincial Government of the Autonomous Province of Vojvodina vojvodina.gov.rs | Government | Serbia | Aug 25, 2026 |
| NTE Italia nteitalia.it | Construction | Italy | Aug 22, 2026 |
| Frisian Flag Indonesia frisianflag.com | Not identified | Indonesia | Aug 21, 2026 |
| Junta de Comunidades de Castilla-La Mancha castillalamancha.es | Government | Spain | Aug 19, 2026 |
| DL E&C dlenc.co.kr | Construction | South Korea | Aug 19, 2026 |
| Doimo Cucine doimocucine.com | Manufacturing | Italy | Aug 19, 2026 |
| Alpine Europe alpine-europe.com | Automotive | Germany | Aug 17, 2026 |
| INFOSAT infosat.ma | Technology | Not identified | Aug 17, 2026 |
| SAGASTA sagasta.cz | Not identified | Czech Republic | Aug 17, 2026 |
Showing the 20 most recent of 25. Browse recent data breaches for more.
Panzer leak site
The address we've seen Panzer publish victims from. Any .onion address needs the Tor Browser.
pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion
Panzer questions
Is Panzer still active?
Yes. Panzer posted its most recent victim on September 15, 2026. That's 20 victims in the last 30 days.
How many victims has Panzer claimed?
Panzer has named 25 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Panzer first appear?
The first victim we recorded for Panzer was posted on August 6, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Panzer target?
Manufacturing accounts for the most victims we can classify, with 4. Government follows at 3. We could identify a sector for 18 of 25 victims, so treat this as the shape of the targeting rather than a full census.
Has Panzer already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.