akd-ekbo.de listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Germany
• Sector: Education
• Announcement date: August 26, 2025

The institution akd-ekbo.de has been listed on the leak site of the ransomware group known as safepay. This announcement, made by the threat actor group, follows a claimed intrusion into the organization's digital infrastructure.

The claims made by safepay

The safepay group officially listed akd-ekbo.de on their dedicated leak site on August 26, 2025. According to the group's announcement, they claim to have successfully gained access to the systems belonging to the institution. The claim suggests that the attack specifically targets the institution's educational operations, potentially disrupting the core functions of the organization.

While the group has publicized the victim's name, the specific details regarding the timeline of the intrusion remain tied to the group's own assertions. This type of public listing is a common tactic used by ransomware operators to exert pressure on their targets.

Details regarding the alleged data breach

Regarding the specifics of the incident, no information has been provided by the group concerning the nature of the data allegedly leaked. There is no available information regarding the volume of files involved or the specific types of data that may have been accessed during the claimed attack.

The listing names no specific data types as being compromised at this time.

About akd-ekbo.de

Amt für kirchliche Dienste (AKD) is the central educational institution of the Evangelical Church in Berlin-Brandenburg-Silesian Upper Lusatia. The organization serves a vital role within the church by providing professional development and training programs. These programs are designed for both professional and volunteer staff members working within the church's framework.

Implications and potential risks

This claim may lead to significant disruptions in the institution's operational processes and a potential loss of institutional reputation. Because the institution operates in Germany, any potential data breach could result in legal sanctions under the General Data Protection Regulation (GDPR). The legal framework in the European Union places strict requirements on how organizations handle and protect personal data, and failures in security can lead to heavy regulatory scrutiny.

The fact that the safepay group employs a double-extortion strategy is a critical factor in this situation. Double extortion is a ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method increases the pressure on the victim, as the threat of data exposure remains even if systems are restored from backups. Consequently, the institution's data may be at risk of being published on the dark web.

Such a scenario could create secondary risks, including identity theft or targeted phishing attacks directed at the institution's staff and the participants of its various educational programs. When personal information is leaked, attackers often use it to craft highly convincing fraudulent communications to exploit individuals further.

It is also worth noting the profile of the threat actor. The emergence of the safepay group in late 2024 suggests that their activities may still be in a developmental phase. As new ransomware groups emerge, they often refine their techniques and targets, making them a variable in the current threat landscape.

In general, organizations in the education sector can mitigate these risks by implementing robust security frameworks. This includes maintaining strict access controls, ensuring regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized intrusions. Furthermore, educating staff on the dangers of phishing can help prevent the initial access that many ransomware groups rely upon to enter a network.