SETTRA
Data as of October 1, 2026.
Credential exposure before the attack
24.7% of SETTRA victims whose domain we can identify (19 of 77) had employee credentials leak in the 12 months before SETTRA named them as a victim.
We don't know whether any of these credentials were how SETTRA gained initial access.
What industries SETTRA targets
Sector identified for 55 of 77 victims.
| Manufacturing | 17 | |
| Construction | 8 | |
| Retail | 4 | |
| Legal | 4 | |
| Healthcare | 3 | |
| Financial Services | 3 | |
| Telecommunications | 3 | |
| Logistics | 3 |
Where the victims are located
Country identified for 71 of 77 victims.
| United States | 45 | |
| United Kingdom | 5 | |
| Canada | 4 | |
| Australia | 2 | |
| Germany | 2 | |
| Netherlands | 2 | |
| Denmark | 2 | |
| Portugal | 1 |
Most recent SETTRA victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Vestfrost Solutions vestfrostsolutions.com | Manufacturing | Denmark | Sep 24, 2026 |
| Greg Jones Law gregjoneslaw.com | Legal | United States | Sep 23, 2026 |
| Lake Beverage lakebeverage.com | Retail | Not identified | Sep 23, 2026 |
| Moscone Center moscone.com | Not identified | Not identified | Sep 23, 2026 |
| Nam Theun 2 Power namtheun2.com | Not identified | Not identified | Sep 23, 2026 |
| Quantum Marketing Group quantummarketing-group.com | Not identified | United Kingdom | Sep 23, 2026 |
| Universal Auto Group universalautogroup.com | Automotive | United States | Sep 23, 2026 |
| Budget Maintenance Supplies budgetms.com | Not identified | United States | Sep 18, 2026 |
| First Call Hospitality fchhotels.com | Hospitality | United States | Sep 18, 2026 |
| NaturesPlus naturesplus.com | Manufacturing | United States | Sep 18, 2026 |
| Pacific Accounting & Business Services pacificabs.com | Financial Services | United States | Sep 18, 2026 |
| Rottner Tresor rottner-tresor.at | Retail | Austria | Sep 18, 2026 |
| Sánchez y Martín sym.com.mx | Manufacturing | Mexico | Sep 18, 2026 |
| BOOT buroboot.nl | Not identified | Netherlands | Sep 4, 2026 |
| DiaSorin diasorin.com | Not identified | Italy | Sep 4, 2026 |
| Hansler Smith hansler.com | Manufacturing | Canada | Sep 4, 2026 |
| Hagelgans & Veronis hvlawfirm.com | Legal | United States | Sep 4, 2026 |
| Industrias Alegre ialegre.com | Manufacturing | Spain | Sep 4, 2026 |
| MedEvolve medevolve.com | Healthcare | United States | Sep 4, 2026 |
| NeoLife neolife.com | Not identified | Not identified | Sep 4, 2026 |
Showing the 20 most recent of 77. Browse recent data breaches for more.
SETTRA leak site
The address we've seen SETTRA publish victims from. Any .onion address needs the Tor Browser.
settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion
SETTRA questions
Is SETTRA still active?
Yes. SETTRA posted its most recent victim on September 24, 2026. That's 30 victims in the last 30 days.
How many victims has SETTRA claimed?
SETTRA has named 77 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 76 of them were posted in the last 12 months.
When did SETTRA first appear?
The first victim we recorded for SETTRA was posted on June 29, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does SETTRA target?
Manufacturing accounts for the most victims we can classify, with 17. Construction follows at 8. We could identify a sector for 55 of 77 victims, so treat this as the shape of the targeting rather than a full census.
Has SETTRA already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.