STORMOUS
Data as of August 16, 2026.
Credential exposure before the attack
16.2% of STORMOUS victims whose domain we can identify (29 of 179) had employee credentials leak in the 12 months before STORMOUS named them as a victim.
We don't know whether any of these credentials were how STORMOUS gained initial access.
What industries STORMOUS targets
Sector identified for 105 of 179 victims.
| Manufacturing | 20 | |
| Education | 14 | |
| Technology | 13 | |
| Financial Services | 12 | |
| Hospitality | 11 | |
| Healthcare | 9 | |
| Government | 5 | |
| Telecommunications | 4 |
Where the victims are located
Country identified for 102 of 179 victims.
| United Arab Emirates | 9 | |
| United States | 7 | |
| Brazil | 7 | |
| Italy | 7 | |
| United Kingdom | 6 | |
| France | 5 | |
| Spain | 5 | |
| Japan | 5 |
Most recent STORMOUS victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| EOGB Energy Products eogb.co.uk | Manufacturing | United Kingdom | Jun 29, 2026 |
| Esha Cloud Services eshacloudqa.com | Healthcare | United States | Jun 29, 2026 |
| Higuchi Shokai higuchi-inc.co.jp | Manufacturing | Japan | Jun 29, 2026 |
| Higuchi higuchiinc.com | Manufacturing | Japan | Jun 29, 2026 |
| Monoprix monoprix.tn | Retail | Not identified | Jun 29, 2026 |
| Palatine Primary School palatineschool.org | Healthcare | United Kingdom | Jun 29, 2026 |
| Impulso impulso-store.com | Retail | Italy | Jun 25, 2026 |
| Lorenzoni lorenzoni-store.com | Not identified | Italy | Jun 25, 2026 |
| Maglificio Liliana maglificioliliana.com | Manufacturing | Italy | Jun 25, 2026 |
| Montechiaro montechiaro-store.com | Not identified | Italy | Jun 25, 2026 |
| JAG Group jaggroup.com | Not identified | United States | Jun 22, 2026 |
| ML Integrated Technologies mlit.com.my | Technology | Malaysia | Jun 15, 2026 |
| SA2000 sa2000.com | Financial Services | South Africa | Jun 4, 2026 |
| Katholiek Amersfoort katholiekamersfoort.nl | Not identified | Netherlands | Jun 3, 2026 |
| Arc Reinsurance Brokers arc-reins.com | Financial Services | United Arab Emirates | May 18, 2026 |
| United Fidelity Insurance fidelityunited.ae | Financial Services | United Arab Emirates | May 18, 2026 |
| VSP Security Wholesale vspsolutions.com.au | Not identified | Australia | May 18, 2026 |
| Avon Material Supplies ams-group.co.uk | Construction | United Kingdom | May 11, 2026 |
| TTT ttt.vn | Construction | Vietnam | May 5, 2026 |
| Consumer Goods Council of South Africa cgcsa.co.za | Manufacturing | South Africa | May 4, 2026 |
Showing the 20 most recent of 179. Browse recent data breaches for more.
STORMOUS leak sites
Addresses we've seen STORMOUS publish victims from. Any .onion address needs the Tor Browser.
h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onionpdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd.onion6sf5xa7eso3e3vk46i5tpcqhnlayczztj7zjktzaztlotyy75zs6j7qd.onion3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.oniongofile.ioahb6hjhe4nomgfwxequu52hazigh4ty4gdcnrf3r7z5tiyhour5py2id.onionanonfiles.comcheck-host.netmega.nzstniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onion5pbckbo5ra36srfwmb2y6mqpqj7akx3e6ewanujszv7nnjndbbgsjsad.onionlockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
STORMOUS questions
Is STORMOUS still active?
Yes. STORMOUS posted its most recent victim on June 29, 2026.
How many victims has STORMOUS claimed?
STORMOUS has named 179 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 46 of them were posted in the last 12 months.
When did STORMOUS first appear?
The first victim we recorded for STORMOUS was posted on January 15, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does STORMOUS target?
Manufacturing accounts for the most victims we can classify, with 20. Education follows at 14. We could identify a sector for 105 of 179 victims, so treat this as the shape of the targeting rather than a full census.
Has STORMOUS already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.