Comfort.de listed on Safepay leak site following alleged data breach

• Ransomware group: Safepay
• Country: Germany
• Sector: Retail & E-Commerce
• Announcement date: March 30, 2025

Safepay claims data breach at comfort.de

The threat actor known as Safepay has listed the German e-commerce platform comfort.de on its dedicated leak site. This announcement, made on March 30, 2025, constitutes an allegation of a data breach against the organization. While the listing has been made public on the group's platform, the claim remains an assertion by the threat actor.

The Safepay group is recognized for employing double extortion tactics during its campaigns. In a typical double extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom demands are not met. This method places significant pressure on organizations by threatening their reputation and increasing the risk of regulatory scrutiny.

Details of the alleged incident

According to the claims made by the Safepay group, the incident involving comfort.de is linked to an event that allegedly occurred on February 25, 2025. This suggests that the threat actors may have had access to the organization's environment for several weeks before making the public announcement on their leak site.

Regarding the specific content of the breach, the available information is highly limited. The provided screenshot associated with the listing is too blurry to identify any specific content. Consequently, there are no details regarding the nature of the leaked data, nor has any specific information been provided regarding the volume of files or the specific types of data involved in the alleged theft.

Organization profile

Comfort.de is a Germany-based e-commerce platform. The company primarily focuses on the retail and e-commerce sector, specializing in the sale of home textiles, bedding, and various sleep products.

Impact and industry implications

This situation may have a negative impact on the institution's data security processes. Because the organization is based in Germany, a potential data breach could lead to legal sanctions under the General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how personal data must be protected and how breaches must be reported to authorities.

The use of the double extortion method by Safepay increases the potential risks for the organization's stakeholders. Specifically, it may increase the risk of identity theft or targeted phishing attacks directed at the institution's customers and employees. When sensitive information is leaked, attackers often use it to craft highly convincing social engineering campaigns to further exploit individuals.

The Safepay group is reported to have emerged in late 2024. The activities of such emerging ransomware groups can lead to significant operational disruptions across the entire sector. For organizations operating in the retail and e-commerce space, maintaining robust defensive measures is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, ensuring timely software patching, and conducting regular security awareness training for employees to mitigate the risk of phishing and other initial access vectors.