Soul
Data as of November 5, 2026.
Credential exposure before the attack
13% of Soul victims whose domain we can identify (3 of 23) had employee credentials leak in the 12 months before Soul named them as a victim.
We don't know whether any of these credentials were how Soul gained initial access.
What industries Soul targets
Sector identified for 17 of 23 victims.
| Healthcare | 5 | |
| Manufacturing | 4 | |
| Legal | 2 | |
| Technology | 1 | |
| Financial Services | 1 | |
| Construction | 1 | |
| Non-profit | 1 | |
| Energy | 1 |
Where the victims are located
Country identified for 20 of 23 victims.
| United States | 16 | |
| Spain | 2 | |
| Argentina | 1 | |
| Australia | 1 |
Most recent Soul victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Adaris Tech adaristech.com | Technology | Spain | Nov 5, 2026 |
| Agape Health Services agapechc.org | Healthcare | United States | Nov 5, 2026 |
| Nephrology Associates arnapa.com | Not identified | United States | Nov 5, 2026 |
| Aurora Health Management aurorahealthmgt.com | Healthcare | United States | Nov 5, 2026 |
| Codinter codinter.com | Manufacturing | Not identified | Nov 5, 2026 |
| Credipaz credipaz.com | Financial Services | Argentina | Nov 5, 2026 |
| Harbinger Concrete harbingerconcrete.build | Construction | United States | Nov 5, 2026 |
| Laempe Reich laempereich.com | Not identified | United States | Nov 5, 2026 |
| Mid Cumberland Human Resource Agency mchra.com | Non-profit | United States | Nov 5, 2026 |
| Merritt Woodwork merrittwoodwork.com | Manufacturing | United States | Nov 5, 2026 |
| METO Systems metosystems.com | Manufacturing | United States | Nov 5, 2026 |
| Movilfrio movilfrio.com | Not identified | Spain | Nov 5, 2026 |
| Massey, Stotser & Nichols msnattorneys.com | Legal | United States | Nov 5, 2026 |
| Noble Oilfield Services nobleoilfieldservices.com | Energy | United States | Nov 5, 2026 |
| NorthShore Health Centers northshorehealth.org | Healthcare | United States | Nov 5, 2026 |
| Park Place Behavioral Health Care ppbh.org | Not identified | Not identified | Nov 5, 2026 |
| ShopBot Tools shopbottools.com | Manufacturing | United States | Nov 5, 2026 |
| Sky Solutions Panama skysolutions.com.pa | Telecommunications | Not identified | Nov 5, 2026 |
| Southern Cross Digital southerncrossdigital.com.au | Not identified | Australia | Nov 5, 2026 |
| The Vant Group thevantgroup.com | Not identified | United States | Nov 5, 2026 |
Showing the 20 most recent of 23. Browse recent data breaches for more.
Soul leak site
The address we've seen Soul publish victims from. Any .onion address needs the Tor Browser.
codice-ledger.io
Soul questions
Is Soul still active?
Yes. Soul posted its most recent victim on November 5, 2026. That's 23 victims in the last 30 days.
How many victims has Soul claimed?
Soul has named 23 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Soul first appear?
The first victim we recorded for Soul was posted on November 5, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Soul target?
Healthcare accounts for the most victims we can classify, with 5. Manufacturing follows at 4. We could identify a sector for 17 of 23 victims, so treat this as the shape of the targeting rather than a full census.
Has Soul already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.