ShadowByt3$

Active
14 victims named on the leak site
0 in the last 30 days
14 in the last 12 months
Apr 2026 first victim we recorded
Jun 15, 2026 most recent victim posted
4 leak sites tracked

Data as of August 16, 2026.

What industries ShadowByt3$ targets

Sector identified for all 14 victims.

Education7
Technology4
Financial Services1
Retail1
Agriculture1

Where the victims are located

Country identified for 12 of 14 victims.

United States5
India2
Singapore1
United Kingdom1
Argentina1
Switzerland1
Japan1

Every ShadowByt3$ victim

VictimSectorCountryPosted
BreachForums breachforu.msTechnologyNot identifiedJun 15, 2026
Cropwise cropwise.comAgricultureSwitzerlandJun 15, 2026
LEAD School leadschool.inEducationIndiaJun 15, 2026
Nintendo nintendo.comTechnologyJapanJun 15, 2026
Ellucian ellucian.comEducationUnited StatesApr 20, 2026
Stride Learning stridelearning.comEducationUnited StatesApr 17, 2026
Amplify Technology amplifytechnology.co.ukTechnologyUnited KingdomApr 14, 2026
Starbucks starbucks.comRetailUnited StatesApr 14, 2026
UMSA umsa.edu.arEducationArgentinaApr 14, 2026
Hotelogix hotelogix.comTechnologySingaporeApr 13, 2026
Forestal Atlántico Sur fas.com.uyFinancial ServicesNot identifiedApr 10, 2026
University Of Georgia uga.eduEducationUnited StatesApr 10, 2026
Nyaya Nagar Public School nyayanagarpublicschool.comEducationIndiaApr 7, 2026
University of Georgia uga.eduEducationUnited StatesApr 7, 2026

Browse recent data breaches for more.

ShadowByt3$ leak sites

Addresses we've seen ShadowByt3$ publish victims from. Any .onion address needs the Tor Browser.

  • sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion
  • anonfilesnew.com
  • shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion
  • mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion

ShadowByt3$ questions

Is ShadowByt3$ still active?

Yes. ShadowByt3$ posted its most recent victim on June 15, 2026.

How many victims has ShadowByt3$ claimed?

ShadowByt3$ has named 14 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did ShadowByt3$ first appear?

The first victim we recorded for ShadowByt3$ was posted on April 7, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does ShadowByt3$ target?

Education accounts for the most victims we can classify, with 7. Technology follows at 4.

Has ShadowByt3$ already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.