SunCrypt
Data as of August 16, 2026.
Credential exposure before the attack
63.6% of SunCrypt victims whose domain we can identify (21 of 33) had employee credentials leak in the 12 months before SunCrypt named them as a victim.
We don't know whether any of these credentials were how SunCrypt gained initial access.
What industries SunCrypt targets
Sector identified for 2 of 33 victims.
| Education | 1 | |
| Construction | 1 |
Where the victims are located
Country identified for 9 of 33 victims.
| United States | 2 | |
| Belgium | 2 | |
| Netherlands | 1 | |
| Malaysia | 1 | |
| Australia | 1 | |
| Germany | 1 | |
| Switzerland | 1 |
Most recent SunCrypt victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| socotec.us | Construction | United States | Jun 19, 2022 |
| netc.edu | Education | Not identified | Jun 6, 2022 |
| cbp.com.my | Not identified | Malaysia | Apr 25, 2022 |
| forensicdjs.com | Not identified | Not identified | Apr 25, 2022 |
| buren.nl | Not identified | Netherlands | Apr 15, 2022 |
| atlascopco.com | Not identified | Not identified | Apr 14, 2022 |
| okcic.com | Not identified | Not identified | Mar 28, 2022 |
| fitflop.com | Not identified | Not identified | Mar 18, 2022 |
| migros.ch | Not identified | Switzerland | Mar 16, 2022 |
| royalsmilde.com | Not identified | Not identified | Feb 22, 2022 |
| cbc.edu | Not identified | Not identified | Feb 21, 2022 |
| kvktech.com | Not identified | Not identified | Feb 15, 2022 |
| heartlandalliance.org | Not identified | Not identified | Feb 8, 2022 |
| valledelsol.com | Not identified | Not identified | Feb 8, 2022 |
| consumers-supply.com | Not identified | Not identified | Feb 6, 2022 |
| bcj.com | Not identified | Not identified | Dec 5, 2021 |
| hfdcorp.com | Not identified | Not identified | Nov 23, 2021 |
| hermankittle.com | Not identified | Not identified | Nov 23, 2021 |
| outdoorventure.com | Not identified | Not identified | Nov 15, 2021 |
| casiusa.com | Not identified | Not identified | Oct 11, 2021 |
Showing the 20 most recent of 33. Browse recent data breaches for more.
SunCrypt leak sites
Addresses we've seen SunCrypt publish victims from. Any .onion address needs the Tor Browser.
x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onioncjbti5ho5osr7xn3raqwf6zsh3lxajbgd2a64eec5e3fpkxtzhlyh3ad.onionmnekye24ynsibuho7m4ysogs6nyslzqcacn4j4mdbwqianjldru3nnid.onion
SunCrypt questions
Is SunCrypt still active?
Not for over a year. The last victim we recorded was June 19, 2022. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has SunCrypt claimed?
SunCrypt has named 33 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did SunCrypt first appear?
The first victim we recorded for SunCrypt was posted on August 1, 2020. That's when the group entered our collection, which isn't necessarily when it started operating.
Has SunCrypt already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.