Ransomware group
Orion ransomware: victims and leak site activity
The Orion ransomware group has listed 14 victims on its leak site since August 2026; its latest post is from 5 August 2026. Most affected countries: United States, Germany and United Kingdom. Most targeted sector: Manufacturing.
Total posts
14
First seen
2026-08-05
Latest post
2026-08-05
Countries hit
4
About Orion
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
- Leak site (Tor)
- http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid.onion
- Profile
- ransomware.live
Most targeted countries
- United States 5
- Germany 2
- United Kingdom 2
- India 2
Most targeted sectors
- Manufacturing 3
- Professional Services 2
- Retail & E-Commerce 2
- Transportation 2
- Agriculture and Food Production 1
- Financial Services 1
- Healthcare 1
- Technology 1
Orion victims per year
All 14 victims
Search every post in the full table.| Victim | Country | Sector | Discovered |
|---|---|---|---|
| huntongroup.com | United Kingdom | Professional Services | |
| hphood.com | United States | Other | |
| bridgestoneamericas.com | United States | Manufacturing | |
| albanybank.com | United States | Financial Services | |
| ipsenlogistics.com | — | Transportation | |
| hetero.com | — | Healthcare | |
| sitrack.com | Germany | Transportation | |
| kioti.com | United States | Agriculture and Food Production | |
| udhaiyamdhall.com | India | Retail & E-Commerce | |
| emanic.net | Germany | Technology | |
| daubertchemical.com | United States | Manufacturing | |
| morrisgroupint.com | United Kingdom | Professional Services | |
| pricemodern.com | — | Retail & E-Commerce | |
| Nitrex Chemicals India | India | Manufacturing |