Deutsche Bank data breach history (2016-2026): the 2023 MOVEit provider leak and the 2026 ransomware claim
Deutsche Bank’s two cyber incidents in the last ten years both ran through service providers in Germany. In 2023 the MOVEit file-transfer flaw exposed data from its account-switching service, which also hit Postbank customers. In July 2026 a ransomware group claimed Deutsche Bank itself; the bank said the incident was at an external provider. This page covers Deutsche Bank and Postbank, with dates and sources.
Short answer
Was Deutsche Bank hacked?
We found no confirmed breach of Deutsche Bank’s own systems from 2016 to 2026 in the sources we read. In July 2023 Deutsche Bank said a “security incident at one of our external service providers”, the firm running its German account-switching service, had exposed a limited amount of customer data, and that “Deutsche Bank’s systems were not affected.” Commerzbank named the provider as Majorel, which was hit through the MOVEit Transfer flaw. Postbank, owned by Deutsche Bank, confirmed limited impact.
In July 2026 the Unsafe ransomware group listed Deutsche Bank on its leak site and posted what looked like employee records. Deutsche Bank said it had been notified of an incident at an external service provider in Germany and that “there is no indication that Deutsche Bank’s internal systems or networks were or are affected.”
Timeline at a glance
15 Jul 2026Deutsche Bank: incident at an external provider in Germany; no sign its own systems were affected. (Cyber Daily)Confirmed
Jul 2026Unsafe ransomware group lists Deutsche Bank and posts alleged employee data samples. (teiss)Unverified claim
Nov 2025 – Jan 2026Not named in coverage of the SitusAMC or Fried Frank vendor breaches. (Bank Info Security)Not a breach
11 Jul 2023Deutsche Bank confirms its account-switching provider exposed limited customer data; own systems not affected. (BleepingComputer)Confirmed
Jul 2023Postbank confirms limited impact from the same provider incident. (BleepingComputer)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Deutsche Bank incident timeline, in detail
Confirmed = acknowledged by Deutsche Bank, a regulator filing or a court. Reported = credible reporting Deutsche Bank has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Unsafe ransomware group claims Deutsche Bank; the bank points to an external provider
What happened. The Unsafe ransomware group listed Deutsche Bank on its dark-web leak site and posted screenshots of terminal output and commands it said showed database exports. Cybernews researchers who reviewed the samples, as reported by teiss, saw employee email addresses, password hashes, physical addresses and internal database records. Deutsche Bank said it had been notified of an incident at an external service provider in Germany and that “There is also no evidence of unauthorised access to Deutsche Bank’s network.” It said it was working with the provider to “minimise potential cyber risks.”
Impact. Employee data appears in the samples. Whether customer data is involved could not be determined from them. The provider has not been publicly named.
May – Jul 2023ConfirmedThird-party / file transfer (MOVEit)
MOVEit attack on account-switching provider exposes Deutsche Bank and Postbank customer data
What happened. Deutsche Bank said it was notified of a “security incident at one of our external service providers” that runs its account-switching service in Germany. It did not name the provider; Commerzbank told Handelsblatt it was Majorel, and Majorel confirmed it was attacked through the MOVEit Transfer flaw that the Clop gang exploited worldwide. Customers who used the switching service in 2016, 2017, 2018 and 2020 were affected, per BleepingComputer. Postbank confirmed limited impact; Comdirect and ING were also hit.
Impact. Deutsche Bank said only a limited amount of personal data was exposed, that criminals could not access accounts with it but might attempt unauthorised direct debits, and it extended the window to return direct debits to 13 months. It did not say how many customers were affected; affected customers were told directly.
What did the 2026 provider do? Deutsche Bank’s statement, as reported by Cyber Daily, says only “an external service provider” in Germany. One report seen via search describes a marketing and incentive platform for sales partners; some outlets mixed this up with the 2023 account-switching provider. We have not confirmed the provider’s role.
How many customers in 2023? Neither Deutsche Bank nor Postbank published a number. ING said a “low four-digit number” of its own customers were affected; that figure is not Deutsche Bank’s.
The pattern across the record
Both incidents came through German service providers
The 2023 leak ran through an outsourced account-switching service and the 2026 claim through an external provider. Deutsche Bank’s own network was not shown to be breached either time.
Old data held by vendors still leaks
The 2023 exposure covered customers who switched accounts as far back as 2016. Data a vendor kept long after the job was done was still there to steal.
What it means for Deutsche Bank customers — and what to do
For Deutsche Bank and Postbank customers, the realistic risk from these incidents is fraud using leaked names and IBANs, such as unauthorised direct debits and convincing phishing.
1.Check direct debits on your statement
The 2023 leak exposed names and account numbers. Deutsche Bank extended the return window for unauthorised direct debits to 13 months; use it if you see one you did not set up.
2.Treat bank emails, texts and calls with care
Do not click links in messages that claim to be from Deutsche Bank or Postbank. Open the app or type the address yourself.
We found no confirmed breach of Deutsche Bank’s own systems from 2016 to 2026. Customer data was exposed in 2023 through a service provider hit by the MOVEit flaw, and in 2026 a ransomware group made a claim the bank linked to an external provider.
What was the Deutsche Bank data breach in 2023?+
The provider running Deutsche Bank’s German account-switching service, named by Commerzbank as Majorel, was attacked through MOVEit Transfer. Deutsche Bank said a limited amount of personal data was exposed and its own systems were not affected. Postbank customers were also affected.
Was Postbank affected by a data breach?+
Yes, by the same 2023 provider incident. Postbank confirmed limited impact but did not publish a number of customers.
Is there a Deutsche Bank data breach in 2026?+
The Unsafe ransomware group claimed Deutsche Bank in July 2026 and posted alleged employee data. Deutsche Bank said the incident was at an external service provider in Germany and that there was no indication its own systems were affected.
Can criminals take money with a leaked IBAN?+
Deutsche Bank said the 2023 data could not be used to access accounts but could be used to try unauthorised direct debits, which customers can reverse. It extended the return window to 13 months.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Deutsche Bank. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.