Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Kairos
As of Oct 19, 2026, Kairos has listed 97 confirmed victims on its leak site since Jun 26, 2024, 0.3% of all victims tracked by Brandefense. Its most targeted country is United States (53.6% of its victims) and its most targeted sector is Healthcare.
Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and business services in the US, purchasing initial access from brokers and demanding Bitcoin payments.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 97
- Rank By Victims
- #69
- Last Leak-Site Post
- Oct 14, 2026
- Top Country
- United States
- Top Sector
- Healthcare
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 7 |
| June 2026 | 0 |
| July 2026 | 4 |
| August 2026 | 2 |
| September 2026 | 5 |
| October 2026 (month in progress) | 2 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 1 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 4 |
| March 2026 | 4 |
| April 2026 | 8 |
| May 2026 | 7 |
| June 2026 | 0 |
| July 2026 | 4 |
| August 2026 | 2 |
| September 2026 | 5 |
| October 2026 (month in progress) | 2 |
| Month | Confirmed victims |
|---|---|
| June 2024 | 1 |
| July 2024 | 0 |
| August 2024 | 0 |
| September 2024 | 0 |
| October 2024 | 1 |
| November 2024 | 5 |
| December 2024 | 6 |
| January 2025 | 6 |
| February 2025 | 5 |
| March 2025 | 4 |
| April 2025 | 5 |
| May 2025 | 3 |
| June 2025 | 6 |
| July 2025 | 3 |
| August 2025 | 5 |
| September 2025 | 5 |
| October 2025 | 5 |
| November 2025 | 1 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 4 |
| March 2026 | 4 |
| April 2026 | 8 |
| May 2026 | 7 |
| June 2026 | 0 |
| July 2026 | 4 |
| August 2026 | 2 |
| September 2026 | 5 |
| October 2026 (month in progress) | 2 |
Latest Kairos Victims.
Search all 97 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Oceania Digital Communications odc.vu | VUVanuatu | Technology | Not stated | |
| Slate Valley Unified School District slatevalleyunified.org | USUnited States | Education and Research | Not stated | |
| Le Centre National de l'Expertise Hospitalière (CNEH) cneh.com | CNChina | Healthcare | Not stated | |
| Unique Repair Services uniquerepair.com | USUnited States | Unknown | Not stated | |
| Krapf Group krapfgroup.com | USUnited States | Manufacturing | Not stated | |
| Leisure Coast Kitchens leisurecoastkitchens.com.au | AUAustralia | Retail | Not stated |
How They Operate.
Kairos's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Kairos Targets.
History.
First confirmed victim listed on its leak site
First seen in Brandefense data
Busiest month on record: 8 confirmed victims
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.