Storm
Data as of October 1, 2026.
Credential exposure before the attack
19.7% of Storm victims whose domain we can identify (15 of 76) had employee credentials leak in the 12 months before Storm named them as a victim.
We don't know whether any of these credentials were how Storm gained initial access.
What industries Storm targets
Sector identified for 62 of 76 victims.
| Financial Services | 15 | |
| Manufacturing | 14 | |
| Healthcare | 10 | |
| Construction | 6 | |
| Legal | 3 | |
| Government | 3 | |
| Automotive | 3 | |
| Education | 2 |
Where the victims are located
Country identified for 75 of 76 victims.
| United States | 57 | |
| Australia | 7 | |
| Canada | 6 | |
| Germany | 4 | |
| Saudi Arabia | 1 |
Most recent Storm victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Century Management Services centuryny.com | Real Estate | United States | Oct 1, 2026 |
| Gardeners\' Guild gardenersguild.com | Construction | United States | Oct 1, 2026 |
| North Hills Facility Services nhfs.com | Not identified | United States | Oct 1, 2026 |
| Olnick Organization olnickrentals.com | Real Estate | United States | Oct 1, 2026 |
| Silvercup Studios silvercupstudios.com | Not identified | United States | Oct 1, 2026 |
| West County Health Centers wchealth.org | Healthcare | United States | Oct 1, 2026 |
| Agra Industries agraind.com | Construction | United States | Sep 29, 2026 |
| Poca Valley Bank pocavalleybank.com | Financial Services | United States | Sep 29, 2026 |
| Stockham Construction stockhamconstruction.com | Construction | United States | Sep 29, 2026 |
| UC Components uccomponents.com | Manufacturing | United States | Sep 29, 2026 |
| Vintners Distributors vintnersdistributors.net | Retail | United States | Sep 29, 2026 |
| Applied Composites appliedcomposites.com | Manufacturing | United States | Sep 25, 2026 |
| Magna Legal Services magnals.com | Legal | United States | Sep 25, 2026 |
| Manroc Developments manroc.com | Not identified | Canada | Sep 22, 2026 |
| The Money Store themoneystore.com | Not identified | United States | Sep 22, 2026 |
| TrueCore Behavioral Solutions truecorebehavioral.com | Not identified | United States | Sep 22, 2026 |
| First Secure Community Bank 1stsecurebank.com | Financial Services | United States | Sep 21, 2026 |
| American Casting americancastingco.com | Financial Services | United States | Sep 21, 2026 |
| First Secure Bank and Trust firstsecurebank.com | Financial Services | United States | Sep 21, 2026 |
| Johnson Investment Counsel johnsoninv.com | Financial Services | United States | Sep 21, 2026 |
Showing the 20 most recent of 76. Browse recent data breaches for more.
Storm leak site
The address we've seen Storm publish victims from. Any .onion address needs the Tor Browser.
yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onion
Storm questions
Is Storm still active?
Yes. Storm posted its most recent victim on October 1, 2026. That's 39 victims in the last 30 days.
How many victims has Storm claimed?
Storm has named 76 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Storm first appear?
The first victim we recorded for Storm was posted on August 6, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Storm target?
Financial Services accounts for the most victims we can classify, with 15. Manufacturing follows at 14. We could identify a sector for 62 of 76 victims, so treat this as the shape of the targeting rather than a full census.
Has Storm already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.