ZeroHour

unsafe

ransomware group · aka Unsafe, Unsafe ransomware group, Unsafe gang · unknown · active since 2025 (leak-site activity widely reported from mid-2025; exact start date unknown)

Victims · 7d
2▲2 vs prev. week
Victims · 30d
3active targets
Victims · 90d
10
All-time (tracked)
24since 2022-12-22
Last post
09-14 21:49UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Unsafe is a relatively new ransomware and data-extortion operation first observed in mid-2025, known for double-extortion attacks and a public Tor leak site used to name and shame victims. The group drew media attention in June 2025 when it claimed responsibility for an attack on a third-party service provider that exposed Postbank customer data belonging to Deutsche Bank. It claims victims across North America, Europe, and Asia-Pacific, in sectors ranging from financial services and IT services to healthcare, education, and manufacturing. Public technical analysis of its encryptor and initial-access techniques remains limited, with most reporting derived from leak-site claims. Dashboard telemetry shows intermittent posting, with 8 victims tracked in the past 90 days and the most recent post on 2026-08-28.

Tactics & tooling
  • Double extortion: exfiltrates data and threatens publication on its Tor leak site
  • Operates a public leak site naming victims, sometimes without accompanying published data
  • Targets third-party service providers to reach downstream client data (e.g., Deutsche Bank/Postbank incident, 2025)
  • Broad geographic targeting across North America, Europe, and Asia-Pacific
  • Frequently claims mid-sized organizations rather than only large enterprises
  • Initial access techniques not widely documented in public research; unknown
Targeted sectors
financial servicesIT services/consultingsoftware/technologyhealthcarehigher educationmanufacturingaviation/transportlogistics
Notable public victims

Deutsche Bank (Postbank customer data exposed via a third-party service provider attack; widely reported, June 2025), TAG Aviation (leak-site claim), American International College (leak-site claim), Presentations.AI (leak-site claim)

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
geekybunch.com · 23h agoRevenue: $5 million | Views: 5 | Posted: 9/15/2026, 1:57:38 AM | Status: 4d 23h 50m 38s
watchops.com · 3d agoRevenue: $1.3 million | Views: 209 | Posted: 9/12/2026, 6:51:26 PM | Status: 4d 21h 37m 52s
amzur.com · 18d agoRevenue: $73.4 million | Views: 56 | Posted: 8/28/2026, 5:22:13 PM | Status: 4d 22h 50m 41s
Presentations.AI · Aug 10, 2026Revenue: $5 million | Views: 492 | Posted: 8/10/2026, 2:44:12 PM | Status: 9d 16h 15m 42s
DECK APP TECHNOLOGIES PTE. LTD · Aug 10, 2026Revenue: $5 million | Views: 87 | Posted: 8/10/2026, 2:44:12 PM | Status: 9d 22h 42m 45s
Constellation HomeBuilder Systems · Aug 9, 2026Revenue: $138.1M | Views: 75240 | Posted: 8/9/2026, 9:25:11 PM | Status: 8d 22h 13m 50s
https://straightperformance.de/ · Jul 30, 2026Revenue: 2 million | Views: 16727 | Posted: 6/28/2026, 10:31:51 PM | Status: Leaked
Deutsche Bank · Jul 30, 2026Revenue: 30 billion | Views: 17629 | Posted: 7/4/2026, 6:15:19 PM | Status: Leaked
CCR Solutions · Jul 30, 2026Revenue: 41 million | Views: 9012 | Posted: 7/20/2026, 2:30:10 AM | Status: Leaked
Jiva Health · Jul 30, 2026Revenue: 9 million | Views: 6037 | Posted: 7/25/2026, 4:21:02 AM | Status: Leaked
Hartl European Transport Company · Jan 14, 2024
American International College · Jan 14, 2024
SPARTAN Light Metal Products · Jan 14, 2024
TAG Aviation · Jun 10, 2023
SPARTAN Light Metal Products Inc · Apr 17, 2023
Invenergy · Apr 14, 2023
G.R. Sponaugle · Dec 22, 2022
Horwitz Horwitz & Associates · Dec 22, 2022
Wings Etc · Dec 22, 2022
Dooly County School System · Dec 22, 2022
Whatcom County Library System · Dec 22, 2022
The Chedi Muscat · Dec 22, 2022
Barakat Travel Co · Dec 22, 2022
Ucar · Dec 22, 2022

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .