RALord
Data as of August 16, 2026.
Credential exposure before the attack
51.9% of RALord victims whose domain we can identify (14 of 27) had employee credentials leak in the 12 months before RALord named them as a victim.
We don't know whether any of these credentials were how RALord gained initial access.
What industries RALord targets
Sector identified for 18 of 27 victims.
| Manufacturing | 4 | |
| Education | 2 | |
| Construction | 2 | |
| Non-profit | 2 | |
| Telecommunications | 2 | |
| Government | 2 | |
| Hospitality | 1 | |
| Retail | 1 |
Where the victims are located
Country identified for 18 of 27 victims.
| France | 3 | |
| Brazil | 2 | |
| Mexico | 2 | |
| Argentina | 1 | |
| Taiwan | 1 | |
| United States | 1 | |
| Spain | 1 | |
| Egypt | 1 |
Most recent RALord victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Diallog Telecommunications diallog.com | Telecommunications | Canada | Apr 28, 2025 |
| Helukabel helukabel.de | Manufacturing | Germany | Apr 24, 2025 |
| Rawafid Industrial rawafid.sa | Construction | Saudi Arabia | Apr 24, 2025 |
| Agromate agromate.com.my | Manufacturing | Malaysia | Apr 22, 2025 |
| Bettanin Industrial bettininformatica.com.br | Technology | Brazil | Apr 21, 2025 |
| Bio-Clima Service bioclimaservice.it | Not identified | Italy | Apr 17, 2025 |
| ARRCO arrco-air.com | Not identified | Norway | Apr 16, 2025 |
| Apunto Telecom apuntotelcom.com | Telecommunications | Spain | Apr 15, 2025 |
| Aeronautical Radio arinc.com | Government | Not identified | Apr 15, 2025 |
| Faculty of Engineering, Cairo University cu.edu.eg | Education | Egypt | Apr 15, 2025 |
| Al-Hejailan Group hejailan.com | Manufacturing | Not identified | Apr 15, 2025 |
| Instituto Nacional de Estadística y Geografía (INEGI) inegi.org.mx | Government | Mexico | Apr 15, 2025 |
| Viavi Solutions jdsu.com | Not identified | Not identified | Apr 15, 2025 |
| Lutron Electronics lutron.com | Manufacturing | Not identified | Apr 15, 2025 |
| Newhotel Software newhotel.com | Not identified | Not identified | Apr 15, 2025 |
| Remote Sensing Systems remss.com | Not identified | Not identified | Apr 15, 2025 |
| Rajasthan Youth Association (RYA) Book Bank ryabookbank.com | Financial Services | Not identified | Apr 15, 2025 |
| County of San Bernardino sbcounty.gov | Not identified | Not identified | Apr 15, 2025 |
| Poder Judicial del Estado de Oaxaca tribunaloaxaca.gob.mx | Not identified | Mexico | Apr 15, 2025 |
| HASBCO hasbco.com | Retail | United States | Apr 11, 2025 |
Showing the 20 most recent of 27. Browse recent data breaches for more.
RALord leak sites
Addresses we've seen RALord publish victims from. Any .onion address needs the Tor Browser.
ralordqe33mpufkpsr6zkdatktlu3t2uei4ught3sitxgtzfmqmbsuyd.onionralord3htj7v2dkavss2hjzviviwgsf4anfdnihn5qcjl6eb5if3cuqd.onionmega.nz
RALord questions
Is RALord still active?
Not for over a year. The last victim we recorded was April 28, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has RALord claimed?
RALord has named 27 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did RALord first appear?
The first victim we recorded for RALord was posted on March 26, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RALord target?
Manufacturing accounts for the most victims we can classify, with 4. Education follows at 2. We could identify a sector for 18 of 27 victims, so treat this as the shape of the targeting rather than a full census.
Has RALord already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.