Unsafe

Active
21 victims named on the leak site
2 in the last 30 days
9 in the last 12 months
Dec 2022 first victim we recorded
Sep 14, 2026 most recent victim posted
2 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

9.5% of Unsafe victims whose domain we can identify (2 of 21) had employee credentials leak in the 12 months before Unsafe named them as a victim.

We don't know whether any of these credentials were how Unsafe gained initial access.

What industries Unsafe targets

Sector identified for 13 of 21 victims.

Technology3
Financial Services2
Construction2
Education2
Manufacturing1
Healthcare1
Logistics1
Hospitality1

Where the victims are located

Country identified for 11 of 21 victims.

United States7
Germany2
Canada1
France1

Most recent Unsafe victims

VictimSectorCountryPosted
WatchOps watchops.comTechnologyUnited StatesSep 14, 2026
Amzur Technologies amzur.comTechnologyUnited StatesAug 31, 2026
Presentations.AI presentations.aiTechnologyNot identifiedAug 11, 2026
Constellation HomeBuilder Systems constellationhb.comConstructionCanadaAug 10, 2026
Blue Vista Capital Management bluevistallc.comFinancial ServicesUnited StatesJul 31, 2026
Deutsche Bank db.comFinancial ServicesGermanyJul 31, 2026
Jiva Health jivahealth.comHealthcareUnited StatesJul 31, 2026
StraightPerformance straightperformance.deNot identifiedGermanyJul 31, 2026
CCR Solutions ccrsolutions.comNot identifiedUnited StatesJul 20, 2026
TAG Aviation tagaviation.comNot identifiedNot identifiedJun 12, 2023
spartanlmp.comManufacturingNot identifiedApr 18, 2023
invenergy.comNot identifiedNot identifiedApr 14, 2023
American International College aic.eduEducationUnited StatesJan 15, 2023
Hartl Connect hartlconnect.comLogisticsNot identifiedJan 15, 2023
chedimuscat.comHospitalityNot identifiedDec 22, 2022
k12.ga.usEducationUnited StatesDec 22, 2022
grsponaugle.comConstructionNot identifiedDec 22, 2022
horwitzlaw.comNot identifiedNot identifiedDec 22, 2022
ucar.frNot identifiedFranceDec 22, 2022
wcls.orgNot identifiedNot identifiedDec 22, 2022

Showing the 20 most recent of 21. Browse recent data breaches for more.

Unsafe leak sites

Addresses we've seen Unsafe publish victims from. Any .onion address needs the Tor Browser.

  • unsafeipw6wbkzzmj7yqp7bz6j7ivzynggmwxsm6u2wwfmfqrxqrrhyd.onion
  • santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion

Unsafe questions

Is Unsafe still active?

Yes. Unsafe posted its most recent victim on September 14, 2026. That's 2 victims in the last 30 days.

How many victims has Unsafe claimed?

Unsafe has named 21 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 9 of them were posted in the last 12 months.

When did Unsafe first appear?

The first victim we recorded for Unsafe was posted on December 22, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Unsafe target?

Technology accounts for the most victims we can classify, with 3. Financial Services follows at 2. We could identify a sector for 13 of 21 victims, so treat this as the shape of the targeting rather than a full census.

Has Unsafe already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.