unsafe
ransomware group · aka Unsafe, Unsafe ransomware group, Unsafe gang · unknown · active since 2025 (leak-site activity widely reported from mid-2025; exact start date unknown)
Unsafe is a relatively new ransomware and data-extortion operation first observed in mid-2025, known for double-extortion attacks and a public Tor leak site used to name and shame victims. The group drew media attention in June 2025 when it claimed responsibility for an attack on a third-party service provider that exposed Postbank customer data belonging to Deutsche Bank. It claims victims across North America, Europe, and Asia-Pacific, in sectors ranging from financial services and IT services to healthcare, education, and manufacturing. Public technical analysis of its encryptor and initial-access techniques remains limited, with most reporting derived from leak-site claims. Dashboard telemetry shows intermittent posting, with 8 victims tracked in the past 90 days and the most recent post on 2026-08-28.
- Double extortion: exfiltrates data and threatens publication on its Tor leak site
- Operates a public leak site naming victims, sometimes without accompanying published data
- Targets third-party service providers to reach downstream client data (e.g., Deutsche Bank/Postbank incident, 2025)
- Broad geographic targeting across North America, Europe, and Asia-Pacific
- Frequently claims mid-sized organizations rather than only large enterprises
- Initial access techniques not widely documented in public research; unknown
Deutsche Bank (Postbank customer data exposed via a third-party service provider attack; widely reported, June 2025), TAG Aviation (leak-site claim), American International College (leak-site claim), Presentations.AI (leak-site claim)
No public figure.
Leak-site victims24 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| geekybunch.com | · 23h ago | Revenue: $5 million | Views: 5 | Posted: 9/15/2026, 1:57:38 AM | Status: 4d 23h 50m 38s |
| watchops.com | · 3d ago | Revenue: $1.3 million | Views: 209 | Posted: 9/12/2026, 6:51:26 PM | Status: 4d 21h 37m 52s |
| amzur.com | · 18d ago | Revenue: $73.4 million | Views: 56 | Posted: 8/28/2026, 5:22:13 PM | Status: 4d 22h 50m 41s |
| Presentations.AI | · Aug 10, 2026 | Revenue: $5 million | Views: 492 | Posted: 8/10/2026, 2:44:12 PM | Status: 9d 16h 15m 42s |
| DECK APP TECHNOLOGIES PTE. LTD | · Aug 10, 2026 | Revenue: $5 million | Views: 87 | Posted: 8/10/2026, 2:44:12 PM | Status: 9d 22h 42m 45s |
| Constellation HomeBuilder Systems | · Aug 9, 2026 | Revenue: $138.1M | Views: 75240 | Posted: 8/9/2026, 9:25:11 PM | Status: 8d 22h 13m 50s |
| https://straightperformance.de/ | · Jul 30, 2026 | Revenue: 2 million | Views: 16727 | Posted: 6/28/2026, 10:31:51 PM | Status: Leaked |
| Deutsche Bank | · Jul 30, 2026 | Revenue: 30 billion | Views: 17629 | Posted: 7/4/2026, 6:15:19 PM | Status: Leaked |
| CCR Solutions | · Jul 30, 2026 | Revenue: 41 million | Views: 9012 | Posted: 7/20/2026, 2:30:10 AM | Status: Leaked |
| Jiva Health | · Jul 30, 2026 | Revenue: 9 million | Views: 6037 | Posted: 7/25/2026, 4:21:02 AM | Status: Leaked |
| Hartl European Transport Company | · Jan 14, 2024 | — |
| American International College | · Jan 14, 2024 | — |
| SPARTAN Light Metal Products | · Jan 14, 2024 | — |
| TAG Aviation | · Jun 10, 2023 | — |
| SPARTAN Light Metal Products Inc | · Apr 17, 2023 | — |
| Invenergy | · Apr 14, 2023 | — |
| G.R. Sponaugle | · Dec 22, 2022 | — |
| Horwitz Horwitz & Associates | · Dec 22, 2022 | — |
| Wings Etc | · Dec 22, 2022 | — |
| Dooly County School System | · Dec 22, 2022 | — |
| Whatcom County Library System | · Dec 22, 2022 | — |
| The Chedi Muscat | · Dec 22, 2022 | — |
| Barakat Travel Co | · Dec 22, 2022 | — |
| Ucar | · Dec 22, 2022 | — |
In the newsAll →
No articles mention this group yet.