2026 Deutsche Bank — Unsafe ransomware leak claim (unverified); employee DB alleged
Data compromised
Actor-posted database extracts allegedly showing employee email addresses, password hashes, physical addresses, and internal database records; customer data inclusion unverified in indexed reporting
Technical writeup
Unverified ransomware leak-site claim — indexed July 7, 2026. Cybernews reported the Unsafe ransomware group listed Deutsche Bank on its dark-web leak site with screenshots purporting to show SQL/database exports of employee records including emails, password hashes, physical addresses, and internal HR-style fields. Cybernews researchers noted samples appear tied to internal systems but could not confirm whether customer banking data was included; Deutsche Bank had not publicly corroborated the listing at catalog time. Unsafe resurfaced aggressively in 2026 after a quiet 2024–2025 period. Distinct from Deutsche Bank's verified 2023 MOVEit provider breach (Majorel). Secondary chatter cited ~354 employees and ~4,022 user accounts—BreachHistory indexes 4,022 as the broader actor-adjacent scope claim labeled unverified.
Root cause
Unsafe ransomware group leak-site listing claiming breach of Deutsche Bank internal employee databases—bank had not confirmed at catalog time