Royal
Data as of August 16, 2026.
Credential exposure before the attack
9.4% of Royal victims whose domain we can identify (18 of 192) had employee credentials leak in the 12 months before Royal named them as a victim.
We don't know whether any of these credentials were how Royal gained initial access.
What industries Royal targets
Sector identified for 104 of 192 victims.
| Manufacturing | 20 | |
| Education | 18 | |
| Healthcare | 12 | |
| Construction | 10 | |
| Financial Services | 8 | |
| Logistics | 7 | |
| Energy | 6 | |
| Legal | 6 |
Where the victims are located
Country identified for 53 of 192 victims.
| Germany | 8 | |
| United Kingdom | 6 | |
| United States | 6 | |
| Italy | 5 | |
| Switzerland | 5 | |
| Brazil | 4 | |
| France | 4 | |
| Canada | 3 |
Most recent Royal victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Braintree Public Schools braintreema.gov | Education | Not identified | Jul 20, 2023 |
| Marstrands marstrand.se | Hospitality | Sweden | Jun 12, 2023 |
| Penncrest School District penncrest.org | Education | Not identified | Jun 12, 2023 |
| Tachi-S tachi-s.com | Automotive | Not identified | Jun 12, 2023 |
| AFG afgholdings.com | Not identified | Not identified | May 29, 2023 |
| B & M Precision bmprecision.com | Healthcare | Not identified | May 29, 2023 |
| Grange Packing Solutions co-pack.co.uk | Manufacturing | United Kingdom | May 29, 2023 |
| Colrich colrich.com | Financial Services | Not identified | May 29, 2023 |
| DirectViz directviz.com | Technology | Not identified | May 29, 2023 |
| Haworth Tompkins haworthtompkins.com | Not identified | Not identified | May 29, 2023 |
| Mitutoyo mitutoyo.ch | Not identified | Switzerland | May 29, 2023 |
| Sovitrat sovitrat.fr | Not identified | France | May 29, 2023 |
| The Best Connection thebestconnection.co.uk | Manufacturing | United Kingdom | May 29, 2023 |
| Volt volt.com | Not identified | United States | May 29, 2023 |
| Coos Bay coos.or.us | Not identified | United States | May 24, 2023 |
| Dotcom Distribution dotcomdist.com | Logistics | Not identified | May 24, 2023 |
| Morris Hospital & Healthcare Centers morrishospital.org | Healthcare | Not identified | May 23, 2023 |
| Trinity Exploration and Production trinityexploration.com | Not identified | Not identified | May 23, 2023 |
| Utah-Yamas Controls utahyamas.com | Energy | Not identified | May 23, 2023 |
| westside-health.org | Not identified | Not identified | May 23, 2023 |
Showing the 20 most recent of 192. Browse recent data breaches for more.
Royal leak sites
Addresses we've seen Royal publish victims from. Any .onion address needs the Tor Browser.
royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.oniontkektnwbesdjrcllcdyqmcmtqvgbdbpyxpoa2xpvr2nq4gunbedwenid.onionk6s24pz55gtvtzzpg4riv7zb74vts425bl42zrpmice5ud3a65itj6ad.onionunirvhpzl6fbyvnfhomt6vnbhsdbi2axcfwbu2au4njqf2suuiiqvead.onion7ctqkkbgbzeo4c53wpluqpcrjocaam6334ltj3lmcauuq6rtlwrzvbad.onion72u5vd67xdff354hhge6wjuvsixxwo3c6bvrdlqstgmjfptpbzwrsmad.onionz2vrautxfpjhp6fd2hwcgb25rmtvquooyaqsth4d2gp2ib3zcphpl7ad.onionmega.nzmbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onionyef4xoqj2jq554rqetf2ikmpdtewdlbnx5xrtjtjqaotvfw77ipb6pad.onionanonfiles.comwkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onionttkektnwbesdjrcllcdyqmcmtqvgbdbpyxpoa2xpvr2nq4gunbedwenid.onionutkektnwbesdjrcllcdyqmcmtqvgbdbpyxpoa2xpvr2nq4gunbedwenid.onion6wjqrulydd3k7fx7gbgdh3pjg42swcyfguwrasmkdss3v55i75ftq4id.onion3o22w55gqnqmtrtoggjtlpac4p7jgkrwwnviljihgig3nyv2ds5d5uyd.onionwtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Royal questions
Is Royal still active?
Not for over a year. The last victim we recorded was July 20, 2023. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Royal claimed?
Royal has named 192 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Royal first appear?
The first victim we recorded for Royal was posted on February 7, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Royal target?
Manufacturing accounts for the most victims we can classify, with 20. Education follows at 18. We could identify a sector for 104 of 192 victims, so treat this as the shape of the targeting rather than a full census.
Has Royal already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.