Level listed on desolator ransomware leak site

• Ransomware group: desolator
• Country: United States
• Sector: Financial Services
• Announcement date: September 1, 2025

Desolator claims attack on Level

The desolator ransomware group has listed the financial services company Level on its leak site. According to the announcement made on September 1, 2025, the group claims to have successfully compromised the organization. The group asserts that the attack process took place on August 31, 2025. Following the initial claim, the threat actors have established a countdown or waiting period, stating that the alleged data will be published on September 5, 2025, if certain conditions are not met.

Ransomware attacks of this nature often follow a pattern known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The goal is to pressure the victim into paying a ransom by threatening to leak the stolen information on public leak sites. These sites serve as a platform for extortion, where groups post names of victims and countdown timers to increase psychological pressure on the targeted entities.

Alleged data theft and encryption

The announcement from the desolator group claims that 16 GB of data has been encrypted. While the group has provided a screenshot, it does not include a file tree that would allow for a detailed inspection of the directory structure. Despite the lack of a file tree, the group claims that the stolen information includes several sensitive categories of data. The listing specifically mentions the following types of affected information:

• Employee data
• Personally identifiable information (PII)
• Human resources (HR) records

The exposure of such data types poses significant risks to the individuals involved. When personally identifiable information and human resources records are compromised, it can lead to secondary risks for the organization's staff, such as identity theft and targeted phishing attacks. These secondary attacks often leverage the stolen information to gain further access to corporate networks or to defraud the individuals directly.

About Level

Level is a financial technology company that provides corporate spend management and financial automation solutions. The company offers platforms that help businesses digitize and manage their spending processes. Operating within the financial services sector, the organization plays a role in the digital infrastructure used by businesses to oversee their financial activities and automate spending workflows.

Risk assessment and industry implications

This incident highlights the ongoing risk of sensitive data exposure for companies operating within the financial services sector. The alleged leak of employee data and personal information can create significant challenges for an organization. For a US-based entity like Level, a potential data breach may trigger specific notification obligations under relevant state laws and federal regulations, depending on the nature of the data and the residency of the affected individuals.

The motivations and specific methodologies of the desolator group remain uncertain, as information regarding this group is currently limited. Such uncertainty is common in the ransomware landscape, where new or niche groups frequently emerge with varying levels of sophistication. The incident may lead to negative impacts on the organization's operational continuity and overall data privacy standards.

To defend against such threats, organizations in the financial sector typically implement various defensive measures. These include robust encryption for data at rest and in transit, multi-factor authentication (MFA) across all access points, and continuous monitoring of network traffic to detect anomalous behavior. Furthermore, maintaining a rigorous patch management cycle and conducting regular security awareness training can help mitigate the risk of initial access through common vulnerabilities or social engineering.