SETTRA
Data as of August 16, 2026.
Credential exposure before the attack
21.6% of SETTRA victims whose domain we can identify (8 of 37) had employee credentials leak in the 12 months before SETTRA named them as a victim.
We don't know whether any of these credentials were how SETTRA gained initial access.
What industries SETTRA targets
Sector identified for 28 of 37 victims.
| Manufacturing | 9 | |
| Construction | 6 | |
| Agriculture | 2 | |
| Retail | 2 | |
| Legal | 2 | |
| Energy | 2 | |
| Hospitality | 1 | |
| Technology | 1 |
Where the victims are located
Country identified for 36 of 37 victims.
| United States | 25 | |
| United Kingdom | 3 | |
| Germany | 2 | |
| Portugal | 1 | |
| Singapore | 1 | |
| Taiwan | 1 | |
| France | 1 | |
| Australia | 1 |
Most recent SETTRA victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Advanced Tax Solutions advancedtaxsolutions.com | Financial Services | United States | Aug 12, 2026 |
| FirstDigital firstdigital.com | Telecommunications | United States | Aug 12, 2026 |
| Flowco flowco-inc.com | Energy | United States | Aug 12, 2026 |
| Oligo oligo.de | Manufacturing | Germany | Aug 12, 2026 |
| Powdr powdr.com | Not identified | United States | Aug 12, 2026 |
| ProfiNRG profinrg.nl | Energy | Netherlands | Aug 12, 2026 |
| Menlo Systems menlosystems.com | Manufacturing | Germany | Jul 24, 2026 |
| Royal Chain royalchain.com | Manufacturing | United States | Jul 24, 2026 |
| Downies Collectables downies.com | Retail | Australia | Jul 22, 2026 |
| American Color Imaging acilab.com | Not identified | United States | Jul 16, 2026 |
| Samuel D. Koon & Associates samuelkoon.com | Legal | United States | Jul 16, 2026 |
| Torsion Group torsiongroup.co.uk | Construction | United Kingdom | Jul 16, 2026 |
| The Berg bergdemo.com | Construction | United States | Jul 10, 2026 |
| Green Valley Farm Supply gvfsinc.com | Agriculture | United States | Jul 10, 2026 |
| WT Law wtlawllp.co.uk | Legal | United Kingdom | Jul 10, 2026 |
| City Lumber clc-tn.com | Construction | United States | Jul 1, 2026 |
| Ilex Paysages ilex-paysages.com | Not identified | France | Jul 1, 2026 |
| Infinedi infinedi.net | Healthcare | United States | Jul 1, 2026 |
| Joy Construction joyconstructionnyc.com | Construction | United States | Jul 1, 2026 |
| Orion Registrar orion4value.com | Not identified | United States | Jul 1, 2026 |
Showing the 20 most recent of 37. Browse recent data breaches for more.
SETTRA leak site
The address we've seen SETTRA publish victims from. Any .onion address needs the Tor Browser.
settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion
SETTRA questions
Is SETTRA still active?
Yes. SETTRA posted its most recent victim on August 12, 2026. That's 9 victims in the last 30 days.
How many victims has SETTRA claimed?
SETTRA has named 37 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 36 of them were posted in the last 12 months.
When did SETTRA first appear?
The first victim we recorded for SETTRA was posted on June 29, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does SETTRA target?
Manufacturing accounts for the most victims we can classify, with 9. Construction follows at 6. We could identify a sector for 28 of 37 victims, so treat this as the shape of the targeting rather than a full census.
Has SETTRA already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.