TENGU
Data as of August 16, 2026.
Credential exposure before the attack
5.1% of TENGU victims whose domain we can identify (2 of 39) had employee credentials leak in the 12 months before TENGU named them as a victim.
We don't know whether any of these credentials were how TENGU gained initial access.
What industries TENGU targets
Sector identified for 27 of 39 victims.
| Manufacturing | 6 | |
| Government | 4 | |
| Technology | 3 | |
| Financial Services | 3 | |
| Hospitality | 3 | |
| Automotive | 2 | |
| Construction | 2 | |
| Education | 2 |
Where the victims are located
Country identified for 34 of 39 victims.
| United States | 6 | |
| Mexico | 5 | |
| India | 4 | |
| Israel | 2 | |
| Indonesia | 2 | |
| Taiwan | 2 | |
| Italy | 2 | |
| United Arab Emirates | 2 |
Most recent TENGU victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Crown Security crown-security.com.tw | Not identified | Taiwan | Mar 10, 2026 |
| SCI Real Estate scirealestate.com | Financial Services | United States | Mar 9, 2026 |
| Community Mosaic communitymosaic.co.uk | Not identified | United Kingdom | Mar 5, 2026 |
| EOS Technology Solutions eostechnology.net | Technology | United States | Mar 5, 2026 |
| DaintyCloud daintycloud.com | Not identified | United States | Mar 2, 2026 |
| Al Arif Groups alarifgroups.ae | Not identified | United Arab Emirates | Feb 26, 2026 |
| Martec martec.it | Not identified | Italy | Feb 26, 2026 |
| Shora Advisory shora.ma | Financial Services | Not identified | Feb 23, 2026 |
| FEMAR femar.it | Manufacturing | Italy | Feb 19, 2026 |
| Joujuin Temple joujuin.or.jp | Not identified | Japan | Feb 19, 2026 |
| Junta Local CDMX cdmx.gob.mx | Government | Mexico | Feb 11, 2026 |
| Mega Silver megasilver.com.tw | Manufacturing | Taiwan | Feb 5, 2026 |
| B2 Motorsport b2motorsport.co.il | Automotive | Israel | Jan 29, 2026 |
| KSP TLM Indonesia cooptlmindonesia.com | Financial Services | Indonesia | Jan 28, 2026 |
| Lenotech lenotech.com.ph | Not identified | Philippines | Jan 28, 2026 |
| Sky Egypt Tours skyegtours.com | Hospitality | Egypt | Jan 28, 2026 |
| Jakarta Nanyang School jny.sch.id | Education | Indonesia | Jan 27, 2026 |
| National Mining namico.go.ke | Government | Not identified | Jan 27, 2026 |
| Prem Motors premmotors.com | Not identified | India | Jan 27, 2026 |
| Coconut Development Board coconutboard.gov.in | Government | India | Jan 21, 2026 |
Showing the 20 most recent of 39. Browse recent data breaches for more.
TENGU leak sites
Addresses we've seen TENGU publish victims from. Any .onion address needs the Tor Browser.
longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onionfuvodyoktsjdwu3mrbbrmdsmtblkxau6l7r5dygfwgzhf36mabjtcjad.onion
TENGU questions
Is TENGU still active?
It's gone quiet. The last victim we recorded was March 10, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has TENGU claimed?
TENGU has named 39 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 36 of them were posted in the last 12 months.
When did TENGU first appear?
The first victim we recorded for TENGU was posted on October 23, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does TENGU target?
Manufacturing accounts for the most victims we can classify, with 6. Government follows at 4. We could identify a sector for 27 of 39 victims, so treat this as the shape of the targeting rather than a full census.
Has TENGU already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.