Underground
Data as of September 15, 2026.
Credential exposure before the attack
38.5% of Underground victims whose domain we can identify (10 of 26) had employee credentials leak in the 12 months before Underground named them as a victim.
We don't know whether any of these credentials were how Underground gained initial access.
What industries Underground targets
Sector identified for 20 of 26 victims.
| Manufacturing | 10 | |
| Construction | 3 | |
| Healthcare | 3 | |
| Financial Services | 2 | |
| Energy | 1 | |
| Agriculture | 1 |
Where the victims are located
Country identified for 7 of 26 victims.
| South Korea | 2 | |
| India | 2 | |
| Slovakia | 1 | |
| Canada | 1 | |
| Taiwan | 1 |
Most recent Underground victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| SFA Engineering sfa.co.kr | Manufacturing | South Korea | Aug 18, 2025 |
| Ge Mao Rubber gmors.com | Manufacturing | Taiwan | Jun 26, 2025 |
| Semex semex.com | Agriculture | Canada | Apr 17, 2025 |
| Sheng Yu Steel shengyusteel.com | Manufacturing | Not identified | Apr 8, 2025 |
| Casio casio.com | Manufacturing | India | Feb 19, 2025 |
| Simmtech simmtech.com | Manufacturing | Not identified | Feb 19, 2025 |
| AFA Systems afasystemsinc.com | Not identified | Not identified | Feb 18, 2025 |
| Simmtech Co., Ltd. simmtech.com | Manufacturing | Not identified | Dec 17, 2024 |
| Healthcare Services Group (HCSG) hcsgcorp.com | Healthcare | Not identified | Oct 16, 2024 |
| Casio Japan casio.com | Manufacturing | India | Oct 11, 2024 |
| RAM Construction Services ramservices.com | Construction | Not identified | Jul 4, 2024 |
| Ethypharm ethypharm.com | Healthcare | Not identified | Jul 2, 2024 |
| Central Securities centralsecurities.com | Financial Services | Not identified | Jun 11, 2024 |
| Belcher Pharmaceuticals belcherpharma.com | Manufacturing | Not identified | May 20, 2024 |
| Kyung Chang kc.co.kr | Manufacturing | South Korea | May 20, 2024 |
| AWWG awwg.com | Not identified | Not identified | May 2, 2023 |
| Bulldog Bag bulldogbag.com | Not identified | Not identified | May 2, 2023 |
| Cochrane Global cochraneglobal.com | Manufacturing | Not identified | May 2, 2023 |
| Creative Business Interiors creativebusinessinteriors.com | Construction | Not identified | May 2, 2023 |
| Frencken Group frenckengroup.com | Healthcare | Not identified | May 2, 2023 |
Showing the 20 most recent of 26. Browse recent data breaches for more.
Underground leak sites
Addresses we've seen Underground publish victims from. Any .onion address needs the Tor Browser.
47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onionundgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion
Underground questions
Is Underground still active?
Not for over a year. The last victim we recorded was August 18, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Underground claimed?
Underground has named 26 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Underground first appear?
The first victim we recorded for Underground was posted on May 2, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Underground target?
Manufacturing accounts for the most victims we can classify, with 10. Construction follows at 3. We could identify a sector for 20 of 26 victims, so treat this as the shape of the targeting rather than a full census.
Has Underground already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.