ScatteredLAPSUSHunters
Data as of August 16, 2026.
Credential exposure before the attack
66% of ScatteredLAPSUSHunters victims whose domain we can identify (31 of 47) had employee credentials leak in the 12 months before ScatteredLAPSUSHunters named them as a victim.
We don't know whether any of these credentials were how ScatteredLAPSUSHunters gained initial access.
What industries ScatteredLAPSUSHunters targets
Sector identified for 28 of 47 victims.
| Retail | 9 | |
| Manufacturing | 5 | |
| Technology | 3 | |
| Logistics | 3 | |
| Financial Services | 2 | |
| Hospitality | 2 | |
| Healthcare | 1 | |
| Construction | 1 |
Where the victims are located
Country identified for 44 of 47 victims.
| United States | 25 | |
| France | 5 | |
| Germany | 3 | |
| Japan | 3 | |
| Australia | 2 | |
| Vietnam | 2 | |
| Mexico | 1 | |
| Sweden | 1 |
Most recent ScatteredLAPSUSHunters victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Telstra telstra.com.au | Telecommunications | Australia | Oct 9, 2025 |
| Air France–KLM airfranceklm.com | Not identified | France | Oct 7, 2025 |
| CIC Vietnam cic.com.vn | Technology | Vietnam | Oct 7, 2025 |
| Puma SE puma.com | Not identified | Germany | Oct 7, 2025 |
| Red Hat, Inc. (redhat.com) redhat.com | Not identified | Not identified | Oct 7, 2025 |
| S&P Global spglobal.com | Not identified | United States | Oct 7, 2025 |
| 1-800Accountant 1800accountant.com | Financial Services | United States | Oct 6, 2025 |
| AAA aaa.com | Financial Services | United States | Oct 6, 2025 |
| Adidas adidas.com | Manufacturing | Germany | Oct 6, 2025 |
| Google AdSense google.com | Not identified | United States | Oct 6, 2025 |
| Aeroméxico aeromexico.com | Not identified | Mexico | Oct 6, 2025 |
| Air France-KLM airfranceklm.com | Not identified | France | Oct 6, 2025 |
| Albertsons albertsonscompanies.com | Retail | United States | Oct 6, 2025 |
| ASICS asics.com | Manufacturing | Japan | Oct 6, 2025 |
| CarMax carmax.com | Retail | United States | Oct 6, 2025 |
| Cartier cartier.com | Not identified | France | Oct 6, 2025 |
| Chanel chanel.com | Not identified | France | Oct 6, 2025 |
| Cisco cisco.com | Technology | United States | Oct 6, 2025 |
| Disney+ disneyplus.com | Not identified | United States | Oct 6, 2025 |
| ENGIE Resources engieresources.com | Manufacturing | United States | Oct 6, 2025 |
Showing the 20 most recent of 47. Browse recent data breaches for more.
ScatteredLAPSUSHunters leak sites
Addresses we've seen ScatteredLAPSUSHunters publish victims from. Any .onion address needs the Tor Browser.
breachforums.hnshinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion
ScatteredLAPSUSHunters questions
Is ScatteredLAPSUSHunters still active?
It's gone quiet. The last victim we recorded was October 9, 2025, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has ScatteredLAPSUSHunters claimed?
ScatteredLAPSUSHunters has named 47 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did ScatteredLAPSUSHunters first appear?
The first victim we recorded for ScatteredLAPSUSHunters was posted on October 6, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does ScatteredLAPSUSHunters target?
Retail accounts for the most victims we can classify, with 9. Manufacturing follows at 5. We could identify a sector for 28 of 47 victims, so treat this as the shape of the targeting rather than a full census.
Has ScatteredLAPSUSHunters already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.