TITAN
Data as of September 14, 2026.
Credential exposure before the attack
8.7% of TITAN victims whose domain we can identify (2 of 23) had employee credentials leak in the 12 months before TITAN named them as a victim.
We don't know whether any of these credentials were how TITAN gained initial access.
What industries TITAN targets
Sector identified for 16 of 23 victims.
| Manufacturing | 4 | |
| Construction | 3 | |
| Logistics | 2 | |
| Technology | 2 | |
| Healthcare | 2 | |
| Automotive | 1 | |
| Government | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 22 of 23 victims.
| Italy | 10 | |
| United States | 4 | |
| Czech Republic | 4 | |
| Taiwan | 1 | |
| France | 1 | |
| Singapore | 1 | |
| India | 1 |
Most recent TITAN victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Alto Calore Servizi altocalore.it | Not identified | Italy | Aug 21, 2026 |
| Condor condor-group.it | Construction | Italy | Aug 21, 2026 |
| CTP S.r.l. ctpsrl.it | Construction | Italy | Aug 21, 2026 |
| Elbor elbor.it | Manufacturing | Italy | Aug 21, 2026 |
| Elcon Megarad elconmegarad.com | Manufacturing | Italy | Aug 21, 2026 |
| Poema poemasrl.it | Technology | Italy | Aug 21, 2026 |
| Tecnologica tecnologicasrl.com | Healthcare | Italy | Aug 21, 2026 |
| Tedesco & Partners tedescoepartners.it | Financial Services | Italy | Aug 21, 2026 |
| Termotecnica Industriale termotecnica.it | Manufacturing | Italy | Aug 21, 2026 |
| Pertinent Healthcare Business Solutions pertinenthbs.com | Healthcare | India | Jul 22, 2026 |
| DataOstrov datost.cz | Technology | Czech Republic | Jul 15, 2026 |
| CC Logistics cc-logistics.cz | Logistics | Czech Republic | Jul 14, 2026 |
| Ozmit ozmit.eu | Not identified | Czech Republic | Jul 14, 2026 |
| Cooperate Service ghz-shop.cz | Construction | Czech Republic | Jul 13, 2026 |
| Eureka Construction eurekaconst.com | Government | United States | Jul 6, 2026 |
| Apex Maritime kln.com | Logistics | United States | May 20, 2026 |
| ABP Autoricambi abpautoricambi.it | Automotive | Italy | May 19, 2026 |
| Crit Tunisie crit-tunisie.net | Not identified | Not identified | May 19, 2026 |
| DFI dfi.com | Manufacturing | Taiwan | May 19, 2026 |
| Dunsguide dunsguide.com | Not identified | United States | May 19, 2026 |
Showing the 20 most recent of 23. Browse recent data breaches for more.
TITAN leak sites
Addresses we've seen TITAN publish victims from. Any .onion address needs the Tor Browser.
x4bccxlsmjsxlnnf3ocvndlshgfkagzytpqmsjnlfykceumnw6i4hkqd.oniontitanblog.org
TITAN questions
Is TITAN still active?
Yes. TITAN posted its most recent victim on August 21, 2026. That's 9 victims in the last 30 days.
How many victims has TITAN claimed?
TITAN has named 23 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did TITAN first appear?
The first victim we recorded for TITAN was posted on May 19, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does TITAN target?
Manufacturing accounts for the most victims we can classify, with 4. Construction follows at 3. We could identify a sector for 16 of 23 victims, so treat this as the shape of the targeting rather than a full census.
Has TITAN already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.