Skip to content
Leak-site post naming Constellation HomeBuilder Systems, captured by ThreatCluster

Constellation HomeBuilder Systems

unsafe

Ransomware leak-site victim intelligence

Files
39
Views
26,488
Posted
Aug 9, 2026
Country
US
Industry
Manufacturing

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

Unsafe claims to have stolen a full database containing documents, corporate contact emails, conversations, and invoices from Constellation HomeBuilder Systems; the group describes it as available for purchase. The leak lists Constellation HomeBuilder Systems as the victim, including the legal name, onion-domain reference, and a stated revenue of $138.1M. The leak page shows a countdown publication status.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Available full database containing all related documents, corporate contact emails, conversations, and invoices. If you’re interested in purchasing it privately, please contact me through the contact page.

Data categories
documentscorporate contact emailsconversationsinvoices
File types seen
pdf × 31png × 7txt × 1
Sample files (38)
check.pdf
check2.pdf
check3.pdf
check5.pdf
check56.pdf
1mil.pdf
bank.pdf
dgocument.pdf
docbbument.pdf
docbument.pdf
docdcument.pdf
docuffment.pdf
docufment.pdf
docufrrment.pdf
docuggment.pdf
docuggtttttttttttment.pdf
docuhment.pdf
docuikment.pdf
docume1nt.pdf
documen1t.pdf
document.pdf
document1.pdf
document2.pdf
document3.pdf
documeyyyyyyynt.pdf
documggggggggggent.pdf
docuvvment.pdf
docuxment.pdf
doffcument.pdf
dokcument.pdf
ldow1.png
ldow2.png
ldow3.png
constellation.invoice.txt
buildtopia_1.png
buildtopia_2.png
buildtopia_3.png
buildtopia_4.png

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Download Source Code
http://c3ljidzt2opf4xzh5crgojivi2ekkt6fapfpyqclpj4bfwdtoexucdid.onion/BuildTopia-Constellation/

Leak-site images (4)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Screenshot of a directory listing containing FTP credentials, including host, username, password, and associated email addresses.
onion leak page505 KB
Screenshot of a data file containing structured information with fields like Name, Email, Job Title, and IP addresses.
onion leak page794 KB
Screenshot of a data table with columns including IDs, names, and various status messages related to appointments and user actions.
onion leak page738 KB