RaidForums
Data as of August 16, 2026.
Credential exposure before the attack
52.5% of RaidForums victims whose domain we can identify (422 of 804) had employee credentials leak in the 12 months before RaidForums named them as a victim.
We don't know whether any of these credentials were how RaidForums gained initial access.
What industries RaidForums targets
Sector identified for 13 of 804 victims.
| Telecommunications | 2 | |
| Government | 2 | |
| Retail | 2 | |
| Technology | 2 | |
| Education | 1 | |
| Healthcare | 1 | |
| Manufacturing | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 273 of 804 victims.
| Turkey | 40 | |
| Brazil | 36 | |
| India | 20 | |
| Malaysia | 19 | |
| Israel | 14 | |
| Mexico | 12 | |
| Russia | 9 | |
| China | 9 |
Most recent RaidForums victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| panteracapital.com | Not identified | Not identified | Feb 25, 2022 |
| trackitt.com | Not identified | Not identified | Feb 25, 2022 |
| bombardier.com | Not identified | Not identified | Feb 24, 2022 |
| dogakoleji.k12.tr | Not identified | Turkey | Feb 24, 2022 |
| jcpenny.com | Not identified | Not identified | Feb 24, 2022 |
| tntvillage.org | Not identified | Not identified | Feb 24, 2022 |
| apcd-saocarlos.org.br | Not identified | Brazil | Feb 23, 2022 |
| cartaodocomerciario.com.br | Not identified | Brazil | Feb 23, 2022 |
| sreci.gob.hn | Not identified | Not identified | Feb 23, 2022 |
| dfa.gov.ph | Not identified | Philippines | Feb 23, 2022 |
| hrsantos.com.br | Not identified | Brazil | Feb 23, 2022 |
| iesposgraduacao.com.br | Not identified | Brazil | Feb 23, 2022 |
| itaol.com.br | Not identified | Brazil | Feb 23, 2022 |
| nih.gov | Not identified | Not identified | Feb 23, 2022 |
| oabsantos.org.br | Not identified | Brazil | Feb 23, 2022 |
| sinsap.com.br | Not identified | Brazil | Feb 23, 2022 |
| sydneyleiloes.com.br | Not identified | Brazil | Feb 23, 2022 |
| unifenas.br | Not identified | Brazil | Feb 23, 2022 |
| diamond-visions.com | Not identified | Not identified | Feb 22, 2022 |
| redhat.com | Not identified | Not identified | Feb 21, 2022 |
Showing the 20 most recent of 804. Browse recent data breaches for more.
RaidForums leak sites
Addresses we've seen RaidForums publish victims from. Any .onion address needs the Tor Browser.
raidforums.comanonfiles.commega.nzbayfiles.comgateway.ipfs.iogofile.iofckdmca.com
RaidForums questions
Is RaidForums still active?
Not for over a year. The last victim we recorded was February 25, 2022. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has RaidForums claimed?
RaidForums has named 804 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did RaidForums first appear?
The first victim we recorded for RaidForums was posted on January 29, 2021. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RaidForums target?
Telecommunications accounts for the most victims we can classify, with 2. Government follows at 2. We could identify a sector for 13 of 804 victims, so treat this as the shape of the targeting rather than a full census.
Has RaidForums already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.