SETTRA

Active
64 victims named on the leak site
27 in the last 30 days
63 in the last 12 months
Jun 2026 first victim we recorded
Sep 4, 2026 most recent victim posted
1 leak site tracked

Data as of September 16, 2026.

Credential exposure before the attack

21.9% of SETTRA victims whose domain we can identify (14 of 64) had employee credentials leak in the 12 months before SETTRA named them as a victim.

We don't know whether any of these credentials were how SETTRA gained initial access.

What industries SETTRA targets

Sector identified for 46 of 64 victims.

Manufacturing14
Construction8
Healthcare3
Legal3
Telecommunications3
Logistics3
Agriculture2
Retail2

Where the victims are located

Country identified for 61 of 64 victims.

United States39
United Kingdom4
Canada4
Australia2
Germany2
Netherlands2
Portugal1
Singapore1

Most recent SETTRA victims

VictimSectorCountryPosted
BOOT buroboot.nlNot identifiedNetherlandsSep 4, 2026
DiaSorin diasorin.comNot identifiedItalySep 4, 2026
Hansler Smith hansler.comManufacturingCanadaSep 4, 2026
Hagelgans & Veronis hvlawfirm.comLegalUnited StatesSep 4, 2026
Industrias Alegre ialegre.comManufacturingSpainSep 4, 2026
MedEvolve medevolve.comHealthcareUnited StatesSep 4, 2026
NeoLife neolife.comNot identifiedNot identifiedSep 4, 2026
Teletek Structures teletekstructures.comNot identifiedCanadaSep 4, 2026
Verve Portraits verveportraits.com.auNot identifiedAustraliaSep 4, 2026
Challenge Financial Services cfsnow.comFinancial ServicesUnited StatesSep 1, 2026
Diversified Body & Paint Shop diversifiedbodyandpaint.comNot identifiedUnited StatesSep 1, 2026
Hatch hatch.groupConstructionCanadaSep 1, 2026
Howard Lumber howardlumber.comConstructionUnited StatesSep 1, 2026
Manhattan Loft manhattanloft.co.ukNot identifiedUnited KingdomSep 1, 2026
Transcar Auto Shippers transcar.comLogisticsUnited StatesSep 1, 2026
Zayo Group zayo.comTelecommunicationsUnited StatesSep 1, 2026
Zonar Systems zonarsystems.comLogisticsUnited StatesSep 1, 2026
AVK Group avkvalves.comManufacturingDenmarkAug 21, 2026
GT Telecom gt-tele.comTelecommunicationsUnited StatesAug 21, 2026
Alphanumeric Systems alphanumeric.comHealthcareUnited StatesAug 19, 2026

Showing the 20 most recent of 64. Browse recent data breaches for more.

SETTRA leak site

The address we've seen SETTRA publish victims from. Any .onion address needs the Tor Browser.

  • settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion

SETTRA questions

Is SETTRA still active?

Yes. SETTRA posted its most recent victim on September 4, 2026. That's 27 victims in the last 30 days.

How many victims has SETTRA claimed?

SETTRA has named 64 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 63 of them were posted in the last 12 months.

When did SETTRA first appear?

The first victim we recorded for SETTRA was posted on June 29, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does SETTRA target?

Manufacturing accounts for the most victims we can classify, with 14. Construction follows at 8. We could identify a sector for 46 of 64 victims, so treat this as the shape of the targeting rather than a full census.

Has SETTRA already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.