← All breaches
Threat actor tracker 28 incidents tracked

Onyx — every breach we're tracking

Running log of incidents attributed to or claimed by Onyx in public reporting, with what was exposed and what victims should do. Updated as new incidents are ingested.

Incidents tracked28
Latest activityNovember 21, 2022
TypeRansomware / extortion

Groups like Onyx steal data first and extort second — and the stolen records rarely stay private. Once a victim organization's data hits a leak site, the personal details inside (names, emails, phones, addresses) get scraped into the same broker-and-dump ecosystem every doxxer searches. If an organization you've used appears below, treat your data as circulating.

Tracked incidents

high November 21, 2022

www.cucafresca.com.br Listed by onyx Ransomware Group

www.cucafresca.com.br was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.candcfarmsupply.com Listed by onyx Ransomware Group

www.candcfarmsupply.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.semaphorehq.com Listed by onyx Ransomware Group

www.semaphorehq.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.baltholding.eu Listed by onyx Ransomware Group

www.baltholding.eu was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.pacmaritime.com Listed by onyx Ransomware Group

www.pacmaritime.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.waynefamilypractice.com Listed by onyx Ransomware Group

www.waynefamilypractice.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.advantagedirectcare.com Listed by onyx Ransomware Group

www.advantagedirectcare.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.arisaseguros.com Listed by onyx Ransomware Group

www.arisaseguros.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.jaspercountysheriffoffice.com Listed by onyx Ransomware Group

www.jaspercountysheriffoffice.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.minex.gob.gt Listed by onyx Ransomware Group

www.minex.gob.gt was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.projectredirectdc.org Listed by onyx Ransomware Group

www.projectredirectdc.org was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.artisticstairs.com Listed by onyx Ransomware Group

www.artisticstairs.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.ackermanplumbinginc.com Listed by onyx Ransomware Group

www.ackermanplumbinginc.com was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high November 21, 2022

www.wayan.com.mx Listed by onyx Ransomware Group

www.wayan.com.mx was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high September 27, 2022

Ministerio de Relaciones Exteriores Listed by onyx Ransomware Group

Ministerio de Relaciones Exteriores was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high August 05, 2022

Borough of Union Beach Listed by onyx Ransomware Group

Borough of Union Beach was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high August 01, 2022

ARISA CORREDORES DE SEGUROS Listed by onyx Ransomware Group

ARISA CORREDORES DE SEGUROS was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high July 26, 2022

CUCA FRESCA Listed by onyx Ransomware Group

CUCA FRESCA was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high July 26, 2022

Artistic Stairs & Railings Listed by onyx Ransomware Group

Artistic Stairs & Railings was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high July 26, 2022

Baltholding OÜ Listed by onyx Ransomware Group

Baltholding OÜ was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high July 26, 2022

WAYAN NATURAL WEAR Listed by onyx Ransomware Group

WAYAN NATURAL WEAR was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 29, 2022

Jasper County Sheriff's Office Listed by onyx Ransomware Group

Jasper County Sheriff's Office was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 29, 2022

Pacific Maritime Industries Corp. Listed by onyx Ransomware Group

Pacific Maritime Industries Corp. was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 29, 2022

WAYNE FAMILY PRACTICE, ASSOC., P.C. Listed by onyx Ransomware Group

WAYNE FAMILY PRACTICE, ASSOC., P.C. was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 29, 2022

Advantage Direct Care Listed by onyx Ransomware Group

Advantage Direct Care was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 29, 2022

C&C FARMERS’ SUPPLY CORP Listed by onyx Ransomware Group

C&C FARMERS’ SUPPLY CORP was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 29, 2022

Semaphore Solutions Inc Listed by onyx Ransomware Group

Semaphore Solutions Inc was listed on the onyx ransomware leak site. The group claims to have stolen internal data.…

high April 02, 2022

Ackerman Plumbing Listed by conti Ransomware Group

Ackerman Plumbing was listed on the conti ransomware leak site. The group claims to have stolen internal data.…

Close the chain attack

Your email leaked. See who’s selling your address.

Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.

Run the free scan — see what leaked →
15 seconds · 15.4B+ records checked · no account, no card
W Choose your protection level COMPARE PLANS →
One-time purge, ongoing monitoring with weekly re-scans and breach alerts, or family-wide coverage — compare every plan and pick what fits.