Termite

Active
44 victims named on the leak site
2 in the last 30 days
20 in the last 12 months
Nov 2024 first victim we recorded
Jul 28, 2026 most recent victim posted
4 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

54.5% of Termite victims whose domain we can identify (24 of 44) had employee credentials leak in the 12 months before Termite named them as a victim.

We don't know whether any of these credentials were how Termite gained initial access.

What industries Termite targets

Sector identified for 29 of 44 victims.

Healthcare7
Logistics4
Manufacturing3
Technology2
Legal2
Education2
Financial Services2
Non-profit1

Where the victims are located

Country identified for 30 of 44 victims.

United States19
France4
United Kingdom2
Australia1
Ireland1
Norway1
Germany1
India1

Most recent Termite victims

VictimSectorCountryPosted
Affinia Healthcare affiniahealthcare.orgHealthcareUnited StatesJul 28, 2026
JD Young Technologies jdyoung.comTechnologyUnited StatesJul 28, 2026
CalFresh ca.govNot identifiedUnited StatesJun 10, 2026
Roland Machinery rolandmachinery.comNot identifiedUnited StatesJun 9, 2026
Wiese USA wieseusa.comNot identifiedUnited StatesJun 9, 2026
IMMI imminet.comManufacturingUnited StatesJun 1, 2026
UEI College uei.eduHealthcareUnited StatesMay 29, 2026
Ramar Foods ramarfoods.comManufacturingUnited StatesMay 18, 2026
LANAP lanap.comHealthcareUnited StatesApr 17, 2026
Noll and Tam Architects nollandtam.comNot identifiedUnited StatesMar 17, 2026
City of Huntington cityofhuntington.comGovernmentUnited StatesMar 9, 2026
Bartram Trail Riding Club bartramtrail.netNot identifiedUnited StatesMar 3, 2026
Jones Haber and Rollings joneshaberlaw.comLegalUnited StatesFeb 26, 2026
Siskiyou Telephone siskiyoutelephone.comTelecommunicationsUnited StatesFeb 26, 2026
Baltimore Museum of Art artsbma.orgNot identifiedUnited StatesFeb 25, 2026
Insight Chicago insightchicago.comNon-profitUnited StatesFeb 25, 2026
Family Health Centers of Southern Indiana fhcenters.orgHealthcareUnited StatesFeb 3, 2026
Hermes Medical Solutions hermesmedical.comTechnologyNot identifiedDec 26, 2025
MedHelp Clinics medhelpclinics.comNot identifiedUnited StatesDec 18, 2025
News-Press & Gazette npgco.comMediaUnited StatesSep 17, 2025

Showing the 20 most recent of 44. Browse recent data breaches for more.

Termite leak sites

Addresses we've seen Termite publish victims from. Any .onion address needs the Tor Browser.

  • termiteuslbumdge2zmfmfcsrvmvsfe4gvyudc5j6cdnisnhtftvokid.onion
  • y4bdg56uaznmbptf7dgp5xn3sjyyh4qodqjrsbziqatnyapmiqqctgid.onion
  • 4xklh64cl2lymm6n5xywinfq4wlchgugvv5a77pm3pta34svnohwl2id.onion
  • bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion

Termite questions

Is Termite still active?

Yes. Termite posted its most recent victim on July 28, 2026. That's 2 victims in the last 30 days.

How many victims has Termite claimed?

Termite has named 44 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 20 of them were posted in the last 12 months.

When did Termite first appear?

The first victim we recorded for Termite was posted on November 18, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Termite target?

Healthcare accounts for the most victims we can classify, with 7. Logistics follows at 4. We could identify a sector for 29 of 44 victims, so treat this as the shape of the targeting rather than a full census.

Has Termite already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.