Ransomware group

Blackwater ransomware: victims and leak site activity

The Blackwater ransomware group has listed 11 victims on its leak site since May 2026; its latest post is from 24 August 2026. Most affected countries: China, Brazil and United States. Most targeted sector: Manufacturing.

Total posts 11
First seen 2026-05-02
Latest post 2026-08-24
Countries hit 6

About Blackwater

Blackwater is a ransomware group that first surfaced in early 2026, combining file encryption with data theft and targeting healthcare organizations, with known victims including Minidoka Memorial Hospital in Idaho.

Leak site (Tor)
http://ejzl7cjxmkx7lzhiqwidmrwtfjv45pkczbc4fnyaut3t7gll3yaiq5id.onion

Most targeted countries

  1. China 3
  2. Brazil 2
  3. United States 2
  4. Argentina 1
  5. India 1
  6. Portugal 1
All countries →

Most targeted sectors

  1. Manufacturing 2
  2. Professional Services 2
  3. Energy & Utilities 1
  4. Government & Defense 1
  5. Healthcare 1
  6. Hospitality 1
All sectors →

Blackwater victims per year

11 2026

All 11 victims

Search every post in the full table.
Victim Country Sector Discovered
www.ptesm.com Portugal —
www.amca.org.ar Argentina Professional Services
www.shalina.com India —
msgas.com.br Brazil Energy & Utilities
txdkj.com China —
www.utourworld.com — Hospitality
Minidoka Memorial Hospital United States Healthcare
Grupo EBD Brazil Professional Services
Shenzhen Gongjin Electronics China Manufacturing
Compass Housing Alliance United States Government & Defense
Tuopu China Manufacturing