TeamXXX
Data as of August 16, 2026.
What industries TeamXXX targets
Sector identified for 9 of 11 victims.
| Healthcare | 2 | |
| Construction | 1 | |
| Government | 1 | |
| Agriculture | 1 | |
| Financial Services | 1 | |
| Manufacturing | 1 | |
| Legal | 1 | |
| Non-profit | 1 |
Where the victims are located
Country identified for 3 of 11 victims.
| Ireland | 1 | |
| Norway | 1 | |
| Sweden | 1 |
Every TeamXXX victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Scania scania.com | Manufacturing | Sweden | Aug 5, 2025 |
| InterCommunity intercommunityct.org | Non-profit | Not identified | Jul 14, 2025 |
| Webster Henry websterhenry.com | Legal | Not identified | Jul 11, 2025 |
| Aetos Capital Asia aetoscapitalasia.com | Financial Services | Not identified | Jun 23, 2025 |
| Belkorp Ag belkorpag.com | Construction | Not identified | Jun 11, 2025 |
| eVent Medical event-medical.com | Healthcare | Not identified | Jun 11, 2025 |
| Interiors Group interiorsgroup.ie | Healthcare | Ireland | Jun 11, 2025 |
| Narvik Havn narvikhavn.no | Government | Norway | Jun 11, 2025 |
| Nationwide Care Services nationwidecare.org | Not identified | Not identified | Jun 11, 2025 |
| Peterpauper peterpauper.com | Not identified | Not identified | Jun 11, 2025 |
| Webber Restaurant Group webberrestaurantgroup.com | Agriculture | Not identified | Jun 11, 2025 |
Browse recent data breaches for more.
TeamXXX leak sites
Addresses we've seen TeamXXX publish victims from. Any .onion address needs the Tor Browser.
tp5cwh6d2b5hekcg6jlhoe6mawa7dlwiv47epvnfmzuaaur2dnaa3uid.onionibb.co
TeamXXX questions
Is TeamXXX still active?
Not for over a year. The last victim we recorded was August 5, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has TeamXXX claimed?
TeamXXX has named 11 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did TeamXXX first appear?
The first victim we recorded for TeamXXX was posted on June 11, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does TeamXXX target?
Healthcare accounts for the most victims we can classify, with 2. Construction follows at 1. We could identify a sector for 9 of 11 victims, so treat this as the shape of the targeting rather than a full census.
Has TeamXXX already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.