Record ID: GRP-0001
Type: Network / Collective
Status: Inactive
Active Since: 2024

Tooda.sh, also referred to as TOoDA, is a small hacker and doxxing collective that operates primarily through the website tooda.sh and related social media accounts. The group is best known for compromising the doxxing platform Doxbin in 2024–2025, deleting or wiping user accounts, locking out administrators, and leaking a database of over 130,000 user identifiers and email addresses along with a so‑called “blacklist” of people who allegedly paid to keep their information off the site. Reporting indicates that the attack was at least partly motivated by a dispute in which Doxbin staff allegedly accused a Tooda member of being a pedophile, leading to a retaliatory breach and doxxing of Doxbin administrators.

The group’s public-facing site tooda.sh uses the slogan “We Ride at Dawn” and lists several pseudonymous members, while hosting highly controversial content including “Pedophile of the Year” lists used as smear tactics within hacker communities. Security write‑ups and breach notifications describe Tooda/TOoDA as a cybercrime group focused on doxxing, account compromise and data dumping rather than traditional ransomware or financially motivated extortion, although the Doxbin breach created significant downstream risk for victims including phishing and identity theft.

• Eco — Listed as a Tooda member on the public tooda.sh site.
• Ego — Listed as a Tooda member on the public tooda.sh site.
• emo — Listed as a Tooda member on the public tooda.sh site; also appears as “emo.rip” in attribution for the leaked Doxbin dataset.
• user — Listed as a Tooda member on the public tooda.sh site.
• Dante — Listed as a Tooda member on the public tooda.sh site.
• meebop6 — Listed as a Tooda member on the public tooda.sh site.
• Clark — Listed as a Tooda member on the public tooda.sh site.

(Only handles and roles publicly self‑attributed by the group are included; no real‑world identities are confirmed here.)

• Doxbin — Notorious doxxing platform targeted in the 2024–2025 breach attributed to TOoDA, resulting in mass user data exposure and administrative lock‑out.
• emo.rip — Handle credited as the source that provided the breached Doxbin data to breach‑notification services, overlapping with the Tooda‑associated alias “emo.”

• 2024-02-12 — Breach of the doxxing website Doxbin, attributed to a group calling themselves “TOoDA,” with data later cataloged as the “Doxbin (TOoDA)” breach and publicly dumped.
• 2024-11-30 — Registration of the domain tooda.sh, later identified as the group’s main public site and infrastructure hub.
• 2025-02-11 — Public reporting details the conflict between Doxbin admins and Tooda members, including allegations that Tooda wiped Doxbin accounts, locked admin access, and leaked user data and administrator doxxes.
• 2025-02-11 — Tooda‑branded social media activity (e.g., @tooda_sh) references the slogan “We Ride At Dawn,” reinforcing the link between the online persona and the tooda.sh site.
• 2025-03-03 — WHOIS records show an update to the tooda.sh domain registration, indicating that the site and, by extension, the group’s web presence remained active.

• Doxbin (TOoDA) data breach — Compromise and public dumping of the Doxbin user database, including approximately 136,000–136,814 user IDs, usernames and email addresses, along with a “blacklist” of individuals who allegedly paid to suppress their data on the platform.

Record created: 2026-05-06. Last updated based on open‑source reporting available as of early 2026.