Ransomware group
Orion ransomware: victims and leak site activity
The Orion ransomware group has listed 14 victims on its leak site since August 2026; its latest post is from 5 August 2026. Most affected countries: United States, Germany and United Kingdom. Most targeted sector: Manufacturing.
Total posts
14
First seen
2026-08-05
Latest post
2026-08-05
Countries hit
4
About Orion
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Most targeted countries
- United States 5
- Germany 2
- United Kingdom 2
- India 2
Most targeted sectors
- Manufacturing 3
- Professional Services 2
- Retail & E-Commerce 2
- Transportation 2
- Agriculture and Food Production 1
- Financial Services 1
- Healthcare 1
- Technology 1
Orion victims per year
All 14 victims
Search every post in the full table.| Victim | Country | Sector | Discovered |
|---|---|---|---|
| huntongroup.com | United Kingdom | Professional Services | |
| hphood.com | United States | Other | |
| bridgestoneamericas.com | United States | Manufacturing | |
| albanybank.com | United States | Financial Services | |
| ipsenlogistics.com | — | Transportation | |
| hetero.com | — | Healthcare | |
| sitrack.com | Germany | Transportation | |
| kioti.com | United States | Agriculture and Food Production | |
| udhaiyamdhall.com | India | Retail & E-Commerce | |
| emanic.net | Germany | Technology | |
| daubertchemical.com | United States | Manufacturing | |
| morrisgroupint.com | United Kingdom | Professional Services | |
| pricemodern.com | — | Retail & E-Commerce | |
| Nitrex Chemicals India | India | Manufacturing |