Constellation HomeBuilder Systems, a software vendor serving residential homebuilders, was added to the victim list of the ransomware group tracked as "unsafe" on 9 August 2026, with the listing describing operational disruption and attempted data compromise. The claim originates from the group's own onion leak site, was picked up by ransomware.live monitoring and republished by hendryadrian.com, and was separately flagged by the ThreatMon Threat Intelligence Team as reported by Undercode News. No victim statement, regulator filing, CERT advisory, or vendor confirmation appears in any available source. Every tier-one detail in this brief therefore rests on the attacker's own posting and secondary monitoring feeds, and the figures those feeds carry do not agree with each other.
What Happened
The sequence, as far as the sources support it, is narrow. On 9 August 2026 at 14:41 UTC, ransomware monitoring picked up a new entry on the "unsafe" leak site at unsafeipw6wbkzzmj7yqp7bz6j7ivzynggmwxsm6u2wwfmfqrxqrrhyd.onion naming Constellation HomeBuilder Systems. The hendryadrian.com writeup (S1) characterises the incident as "a ransomware incident attributed to the threat actor unsafe, resulting in operational disruption and attempted data compromise," classifies the victim's sector as Manufacturing, and places the company in the US. Undercode News (S2) reports the same detection through ThreatMon, timestamped 9 August 2026 at 17:41:20 UTC+3, which is the identical moment expressed in a different timezone. The two reports are not independent corroboration; they are two renderings of one leak-site post.
Undercode News is explicit that this should be read as a claim rather than a confirmed breach, noting there was no dataset description, file sample, ransom note, encryption evidence, or verified list of compromised systems attached to the alert. The hendryadrian.com post carries its own disclaimer that it cannot confirm accuracy and invites an official statement. That is the correct posture, and this brief adopts it: what is confirmed is that the listing exists, not that the intrusion succeeded as described.
Accounts also differ on basic firmographics, which matters because leak-site revenue figures are how these crews justify ransom demands. S1 states revenue of $138.1M and describes the estimated revenue loss linked to the attack as $138.1M, which is almost certainly the leak site's revenue estimate for the company being restated as a loss figure rather than a measured impact. Company profile data surfaced through LinkedIn (S4, S6) puts Constellation HomeBuilder Systems at 150 to 200 employees with annual revenue in the $1M to $10M range, founded 1995, headquartered in Markham, Ontario, Canada, with US operations and staff distributed across Canada, Pakistan, and the United States. So the revenue picture ranges from $138.1M (the "unsafe" leak-site listing via hendryadrian.com) to $1M-$10M (LinkedIn company profile data), a gap of more than an order of magnitude, and the sector label of "Manufacturing" in S1 conflicts with the company's actual profile as a software development firm. Neither the inflated revenue nor the misfiled sector is unusual for leak-site metadata, and both should reduce confidence in any other number the post carries.
What Was Taken
Nothing has been established. No source describes a dataset, a record count, a file tree, a sample, or a category of stolen information. The only characterisation available is the phrase "attempted data compromise" in S1, and "attempted" is doing real work in that sentence: it stops short of claiming exfiltration succeeded. Undercode News states directly that the alert lacked any confirmed dataset description.
What can be said is what would be exposed if the claim proves out, based on the company's own public description of its business. Constellation HomeBuilder Systems provides ERP and construction management software for production, custom, and semi-custom builders (S4, S7), with product lines including NewStar Enterprise and integrations spanning JD Edwards, Hyphen/BuildPro, and Dynamics CRM (S6). A company executive's public profile describes an active data strategy programme built on "leveraging our data assets" and "building new data focused products across multiple verticals and segments" (S6), and a July 2026 HousingWire podcast appearance (S5) featured the company on the theme of data quality over AI tooling. A vendor in that position typically holds builder cost structures, subcontractor and supplier contracts, purchase orders, warranty and homeowner records, and job-site scheduling data across many customer builders. That is an inference about exposure surface, not a claim about what was accessed.
Why It Matters
The significance here is positional rather than volumetric. This is a software and ERP provider sitting upstream of many homebuilders, so a confirmed compromise would be a supply-chain event rather than a single-company loss, and downstream builders would inherit the incident whether or not their own environments were touched. Any builder running NewStar Enterprise or connected integrations should be tracking this listing, not waiting for a breach notification addressed to them.
The construction and building-materials vertical is also demonstrably in season for ransomware operators. Breachsense's 2026 breach index (S3) shows a dense cluster of construction-adjacent victims logged on a single day, 13 July 2026, including CRZ Construcciones (Qilin), Dash Door & Glass (TheGentlemen), Cooperate Service CZ, a building materials distributor (TITAN), and Carrier Transport, an HVAC firm (DeadLock). Separately, Security Arsenal's dark-web unit (S8) profiles PAYLOAD as a low-volume group whose recent visible victimology is 100 percent construction, targeting firms in the $50M to $500M revenue tier. PAYLOAD has no reported connection to this incident and is a distinct actor from "unsafe"; it is cited here only as evidence that multiple independent crews have converged on the same vertical.
The reason those analysts give for the convergence applies squarely to this victim's customer base. Construction firms run decentralised IT across project sites, depend heavily on VPN connectivity, and patch perimeter appliances more slowly than finance or technology sectors (S8). A vendor serving those firms sits at the junction of a soft downstream customer base and a centralised data store, which is precisely the profile that makes ERP providers attractive.
The Attack Technique
Unknown for this incident. No source identifies an initial access vector, malware family, encryption behaviour, dwell time, or lateral movement path for "unsafe" against Constellation HomeBuilder Systems. There is no ransom demand figure and no negotiation detail. The actor "unsafe" itself has no published TTP profile in any of the eight sources; it appears only as a name attached to a leak-site listing.
The nearest available technique baseline is for a different group targeting the same sector. Security Arsenal (S8) reports PAYLOAD favouring exploitation of edge security appliances, leveraging zero-day and n-day flaws in firewall and VPN products from Check Point and Cisco, with a secondary vector of compromising RMM tooling, specifically ConnectWise ScreenConnect, likely to reach MSPs servicing construction clients. Dwell time is assessed as short, roughly three to seven days, because edge RCE removes the need for extended phishing campaigns. Ransom demands are estimated in the mid-to-high seven figures, priced against project blueprints and contract values.
Treat that as sector-level threat modelling for the vertical, not as attribution for this event. Applying PAYLOAD's playbook to "unsafe" would be exactly the kind of false precision this incident does not support.
One publicly visible attack-surface detail is worth noting for defenders mapping the vendor: constellationhb.com resolves to 52.149.172.178, hosted on Microsoft infrastructure, served by five self-hosted nameservers under constellationhbs.com (S7). That is ordinary hosting posture with no observed compromise indicator attached.
What Organizations Should Do
- Homebuilders using Constellation products should open a vendor inquiry now. Ask directly for incident status, whether customer-hosted or SaaS-hosted tenants were affected, and whether any customer data left the environment. Do not treat the absence of a notification as an all-clear while a leak-site listing is live.
- Pull and review integration credentials. NewStar Enterprise, JD Edwards, Hyphen/BuildPro, and Dynamics CRM connections (S6) mean API keys, service accounts, and SSO trusts may span the vendor boundary. Rotate anything shared, and scope service accounts to least privilege before you need to.
- Harden the edge, because that is where this sector is being hit. Patch and inventory firewall and VPN appliances, especially Check Point and Cisco estates, and confirm management interfaces are not internet-facing (S8).
- Lock down RMM tooling. ConnectWise ScreenConnect and equivalent platforms are an actively reported secondary vector into construction-sector MSPs (S8). Enforce MFA on RMM consoles, restrict access by source IP, and alert on out-of-hours session creation.
- Compress detection to fit a three to seven day dwell window. Backup deletion, shadow copy tampering, mass archive creation, and outbound transfers to cloud storage need to page a human the same day, not surface in a weekly report.
- Test restores against a full ERP outage. Assume the platform is unavailable for days and validate that job scheduling, purchasing, and warranty operations have a documented manual fallback.
- Monitor the leak site for follow-on posting. If "unsafe" publishes a dataset or sample, the claim moves from unverified to evidenced, and the response posture should escalate accordingly.
Sources: Ransom! Constellation HomeBuilder Systems (AUG-2026) | Unsafe Ransomware Claims Constellation HomeBuilder Systems as a Vic... | The Most Recent Data Breaches in 2026 - Breachsense | Clint Scherbarth | Why clean data beats cool AI tools with Constellation Homebuilder S... | Paolo Benzan | constellationhb.com at WI. Top Home Builder Software & Construction... | PAYLOAD Ransomware Gang: Low-Volume Construction Targeting & Critic...