RedAlert

Dark since October 13, 2022
6 victims named on the leak site
0 in the last 30 days
0 in the last 12 months
Jul 2022 first victim we recorded
Oct 13, 2022 most recent victim posted
3 leak sites tracked

Data as of August 16, 2026.

What industries RedAlert targets

Sector identified for 2 of 6 victims.

Construction1
Legal1

Where the victims are located

Country identified for 3 of 6 victims.

France1
Finland1
United Kingdom1

Every RedAlert victim

VictimSectorCountryPosted
bbadmin.comNot identifiedNot identifiedSep 22, 2022
coarc.orgNot identifiedNot identifiedAug 15, 2022
keystonelegal.co.ukLegalUnited KingdomJul 21, 2022
vahanen.comConstructionFinlandJul 10, 2022
groupg4.comNot identifiedNot identifiedJul 6, 2022
syredis.frNot identifiedFranceJul 6, 2022

Browse recent data breaches for more.

RedAlert leak sites

Addresses we've seen RedAlert publish victims from. Any .onion address needs the Tor Browser.

  • blog2hkbm6gogpv2b3uytzi3bj5d5zmc4asbybumjkhuqhas355janyd.onion
  • qrcxhs4x2n4a65rk3zbwm5hu6475bi4w2mdjhfmusovnjc6hc6qcv3ad.onion
  • ybxtfftwy2iwfqjy7fvvcrt5sd55fx3sk2yuztbx3y2dxb4dvqdhsiid.onion

RedAlert questions

Is RedAlert still active?

Not for over a year. The last victim we recorded was October 13, 2022. The leak site has published nothing since, though the data it already leaked is still out there.

How many victims has RedAlert claimed?

RedAlert has named 6 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did RedAlert first appear?

The first victim we recorded for RedAlert was posted on July 6, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Has RedAlert already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.