TITAN
Data as of October 1, 2026.
Credential exposure before the attack
12% of TITAN victims whose domain we can identify (3 of 25) had employee credentials leak in the 12 months before TITAN named them as a victim.
We don't know whether any of these credentials were how TITAN gained initial access.
What industries TITAN targets
Sector identified for 18 of 25 victims.
| Manufacturing | 4 | |
| Healthcare | 4 | |
| Construction | 3 | |
| Logistics | 2 | |
| Technology | 2 | |
| Automotive | 1 | |
| Government | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 23 of 25 victims.
| Italy | 10 | |
| United States | 5 | |
| Czech Republic | 4 | |
| Taiwan | 1 | |
| France | 1 | |
| Singapore | 1 | |
| India | 1 |
Most recent TITAN victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Grupo Hospifar hospifar.com | Healthcare | Not identified | Sep 23, 2026 |
| Sherman Chan, DDS shermanchandds.com | Healthcare | United States | Sep 23, 2026 |
| Alto Calore Servizi altocalore.it | Not identified | Italy | Aug 21, 2026 |
| Condor condor-group.it | Construction | Italy | Aug 21, 2026 |
| CTP S.r.l. ctpsrl.it | Construction | Italy | Aug 21, 2026 |
| Elbor elbor.it | Manufacturing | Italy | Aug 21, 2026 |
| Elcon Megarad elconmegarad.com | Manufacturing | Italy | Aug 21, 2026 |
| Poema poemasrl.it | Technology | Italy | Aug 21, 2026 |
| Tecnologica tecnologicasrl.com | Healthcare | Italy | Aug 21, 2026 |
| Tedesco & Partners tedescoepartners.it | Financial Services | Italy | Aug 21, 2026 |
| Termotecnica Industriale termotecnica.it | Manufacturing | Italy | Aug 21, 2026 |
| Pertinent Healthcare Business Solutions pertinenthbs.com | Healthcare | India | Jul 22, 2026 |
| DataOstrov datost.cz | Technology | Czech Republic | Jul 15, 2026 |
| CC Logistics cc-logistics.cz | Logistics | Czech Republic | Jul 14, 2026 |
| Ozmit ozmit.eu | Not identified | Czech Republic | Jul 14, 2026 |
| Cooperate Service ghz-shop.cz | Construction | Czech Republic | Jul 13, 2026 |
| Eureka Construction eurekaconst.com | Government | United States | Jul 6, 2026 |
| Apex Maritime kln.com | Logistics | United States | May 20, 2026 |
| ABP Autoricambi abpautoricambi.it | Automotive | Italy | May 19, 2026 |
| Crit Tunisie crit-tunisie.net | Not identified | Not identified | May 19, 2026 |
Showing the 20 most recent of 25. Browse recent data breaches for more.
TITAN leak sites
Addresses we've seen TITAN publish victims from. Any .onion address needs the Tor Browser.
x4bccxlsmjsxlnnf3ocvndlshgfkagzytpqmsjnlfykceumnw6i4hkqd.oniontitanblog.org
TITAN questions
Is TITAN still active?
Yes. TITAN posted its most recent victim on September 23, 2026. That's 2 victims in the last 30 days.
How many victims has TITAN claimed?
TITAN has named 25 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did TITAN first appear?
The first victim we recorded for TITAN was posted on May 19, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does TITAN target?
Manufacturing accounts for the most victims we can classify, with 4. Healthcare follows at 4. We could identify a sector for 18 of 25 victims, so treat this as the shape of the targeting rather than a full census.
Has TITAN already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.