Skip to content
Breach Index · running record

DWS Group data breach history (2016-2026): no confirmed breach, account takeovers and impersonation scams

DWS, Deutsche Bank’s asset manager, has no public breach of its own systems in the last ten years in the sources we read. What the record does show is fraud aimed at individual investors: US fund filings describing identity-theft takeovers of single shareholder accounts, and DWS’s own warnings about fake websites and WhatsApp groups using its name. From November 2026 DWS is moving to the brand “Deutsche Asset Management”.

Short answer

Was DWS hacked?

We found no confirmed breach of DWS Group’s own systems from 2016 to 2026 in the sources we read. We also found no ransomware leak-site claim against DWS and no cybersecurity fine.

DWS-branded US mutual funds have told the SEC, in fidelity-bond filings, about identity-theft fraud on individual shareholder accounts: claims of about $72,000 (2019) and $69,000 (2020), and notices of about $182,000 and $23,000 (2024) and $138,500 (2025). One filing describes an account takeover from around August 2018 in which impostors changed the username, password and email on a shareholder’s account. These are attacks on single customers’ logins, not a breach of DWS’s systems.

DWS has also warned that fraudsters misuse its name and its employees’ names on fake websites, social media, WhatsApp groups and apps (via search). With the rebrand to Deutsche Asset Management from November 2026, expect scammers to use both names.

Timeline at a glance

  1. Oct 2019DWS funds file bond claim of $71,981.73 for identity-theft fraud on a shareholder account. (SEC 40-17GCS)Confirmed
  2. Oct 2020Claim of $69,430.02 after an account takeover that began around Aug 2018. (SEC 40-17GCS)Confirmed
  3. May 2024Notice of a potential ~$182,000 claim for identity-theft fraud on a shareholder account. (SEC 40-17GCS)Confirmed
  4. Sep 2024Notice of a potential ~$23,000 claim, another single-account fraud. (SEC 40-17GCS)Confirmed
  5. Jan 2025Notice of a potential ~$138,500 claim across six DWS funds for alleged account fraud. (SEC 40-17GCS)Confirmed
  6. Nov 2026DWS starts using the brand Deutsche Asset Management; websites move to deutsche-am.com. (RankiaPro)Not a breach

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

DWS Group incident timeline, in detail

Confirmed = acknowledged by DWS Group, a regulator filing or a court. Reported = credible reporting DWS Group has not fully confirmed. Unverified claim = an attacker or leak-site claim.

2018 - 2025ConfirmedAccount takeover / customer fraud

Identity-theft takeovers of individual DWS fund shareholder accounts, disclosed in SEC bond filings

What happened. US mutual funds must file Form 40-17GCS when they claim on their fidelity bond. DWS-branded trusts filed five such notices between 2019 and 2025 for “identity theft fraudulent activity perpetrated on a shareholder’s account” (2025: “alleged fraudulent activity”). The October 2020 filing’s release describes impostors who, from around August 2018, took over one shareholder’s online account and changed the username, password and email address.

Impact. Claims and notices: $71,981.73 (2019, $57,585.38 paid by the insurer), $69,430.02 (2020, $55,544.02 paid), about $182,000 (May 2024), about $23,000 (September 2024) and about $138,500 across six funds (January 2025). Each concerns individual accounts. None of the filings describes a breach of DWS or its transfer agent’s systems.

Sources: Form 40-17GCS, 1 Oct 2019 · Form 40-17GCS, 29 Oct 2020 · Form 40-17GCS, 28 May 2024 · Form 40-17GCS, 3 Sep 2024 · Form 40-17GCS, 24 Jan 2025

OngoingNot a breachBrand impersonation / investment scam

Impersonation: fake DWS websites, social media pages, WhatsApp groups and apps

What happened. DWS has published a security note (seen via search; the page now loads client-side) saying fraudsters misuse the DWS trademark and DWS employees’ names online, running fake websites, Facebook pages, WhatsApp groups and mobile apps, and that DWS has no Facebook “Ambassador” profiles or WhatsApp chats.

Impact. No DWS data is involved; victims are people persuaded to pay fake “DWS” operators. The November 2026 rebrand gives scammers a second name to borrow.

Sources: DWS security note (via search) · RankiaPro, 8 Sep 2026 (rebrand)

Where the reports disagree

  • Not a breach: in August 2022 DWS wrote to up to 17,000 German customers to confirm addresses and blocked sales from depots with no valid address, per FondsSuperMarkt. That was an address-records clean-up, not a security incident.
  • Name: the parent stays DWS Group GmbH & Co. KGaA and the DWS brand continues in Germany and key European markets; “Deutsche Asset Management” is the global umbrella brand from November 2026, per RankiaPro.

The pattern across the record

The attacks target customers, not DWS

The documented losses are single shareholder accounts taken over with stolen or reset credentials. Login security and change-of-details checks matter more here than perimeter defence.

A big brand attracts impersonators

Fake sites and chat groups using an asset manager’s name are common across Europe. A rebrand is a fresh opportunity for them.

What it means for DWS Group investors — and what to do

If you invest with DWS or its Xtrackers ETFs, the realistic risks are someone taking over your online account and fake “DWS” or “Deutsche Asset Management” offers.

  1. 1.Lock down your fund account login

    Use a unique password and the strongest sign-in option offered, and ask for alerts when your email, address or bank details change.

    Account takeover lab
  2. 2.Check the domain before you trust it

    From November 2026 DWS websites redirect to deutsche-am.com. Type the address yourself rather than following a link from an ad or chat.

  3. 3.No real asset manager runs WhatsApp trading groups

    DWS says it has no WhatsApp chats. Leave any group that claims to be DWS staff.

    WhatsApp scam spotter

CISO takeaways

Practise an account-takeover response

Detect and reverse a takeover before money moves: detail changes, step-up checks, call-backs.

Account Takeover Lab
Plan for impersonation around a rebrand

Register look-alike domains, tell customers the new address in advance and monitor for clones.

Identity protection lab

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Deutsche DWS funds, Form 40-17GCS (identity-theft bond claim) — SEC EDGAR, 1 Oct 2019
  2. 2.Deutsche DWS Securities Trust, Form 40-17GCS — SEC EDGAR, 29 Oct 2020
  3. 3.DWS Short Duration Fund / DWS Equity 500 Index Fund, Form 40-17GCS — SEC EDGAR, 28 May 2024
  4. 4.Cash Account Trust / Deutsche DWS Market Trust, Form 40-17GCS — SEC EDGAR, 3 Sep 2024
  5. 5.Multiple DWS registrants, Form 40-17GCS — SEC EDGAR, 24 Jan 2025
  6. 6.DWS will be renamed as Deutsche Asset Management globally — RankiaPro, 8 Sep 2026
  7. 7.DWS security note: warning of attempted fraud in the name of DWS (via search) — DWS, undated
  8. 8.DWS: Fehlerhafte Kundenadressen und Sperrung von Verfügungen — FondsSuperMarkt, 3 Aug 2022

Frequently asked questions

Was DWS hacked?

We found no confirmed breach of DWS Group’s own systems from 2016 to 2026, and no ransomware claim against it. The documented incidents are fraud on individual shareholder accounts and impersonation scams.

Has DWS had a data breach?

Not one we could find. US fund filings show identity-theft takeovers of single shareholder accounts between 2018 and 2025, which hit individual customers rather than DWS’s systems.

Is a WhatsApp group run by DWS real?

DWS says it has no WhatsApp chats and that fraudsters run fake groups, websites and apps in its name. Treat any such group as a scam.

Why does dws.com now go to deutsche-am.com?

DWS Group announced in September 2026 that it is adopting Deutsche Asset Management as its global brand from early November 2026, with the rollout running to March 2027. The redirect is expected; check the address yourself rather than trusting links.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by DWS Group. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.