ctd-dortmund.de targeted by Safepay ransomware group

• Ransomware group: Safepay
• Country: Germany
• Announcement date: May 21, 2025

Safepay claims data breach at ctd-dortmund.de

The Safepay ransomware group has published an announcement on its leak site claiming to have leaked 60 GB of data belonging to ctd-dortmund.de. This announcement, which appeared on the group's platform on May 21, 2025, marks a significant development in the ongoing threat landscape facing European educational institutions.

Details of the alleged attack

According to the claims made by the Safepay group, the institution was compromised on April 8, 2025. This implies that the threat actors may have maintained access to the network for several weeks before the public announcement was made. In their listing, the group specifically noted that the organization has an annual revenue of $5 million, a detail often used by ransomware actors to gauge the potential financial impact of their extortion attempts.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public gallery for breached organizations, creating reputational pressure. The timing between the initial compromise and the public listing can vary, but the gap in this instance suggests a period of undetected presence within the victim's infrastructure.

Data involved in the leak

Regarding the specific contents of the alleged breach, there is no detailed information regarding the content of the allegedly leaked data. The information provided by the threat actors is limited, as the screenshot provided by the group only indicates the total size of the data, which is reported to be 60 GB. The listing names no specific data types or file categories.

In many modern ransomware campaigns, the volume of data exfiltrated is a primary metric used by attackers to demonstrate the scale of their success. While the total size is known in this case, the lack of specific file types or categories makes it difficult to determine the exact nature of the sensitive information that may have been targeted.

Organization profile

CTD Dortmund is an educational institution based in Dortmund, Germany, specializing in vocational training, certification, and integration into the labor market.

Impact and security considerations

This alleged data breach may negatively impact the institution's operational continuity and commercial reputation. As the institution is based in Germany, potential exposure of personal data could lead to legal consequences under GDPR. The General Data Protection Regulation (GDPR) imposes strict requirements on how organizations handle personal data and mandates specific notification procedures in the event of a breach.

The Safepay group is known to employ double-extortion tactics. In these scenarios, attackers do not just encrypt data to disrupt operations; they also steal sensitive information to threaten its public release. The publication of this data may lead to secondary risks such as identity theft or targeted phishing attacks against the institution's students, staff, or partners.

For organizations facing similar threats, it is advisable to evaluate data breach notification obligations and review network security. Common defensive steps include implementing robust access controls, maintaining offline backups, and conducting regular security audits to detect unauthorized presence early. Given the potential for secondary attacks like phishing, heightened monitoring of communication channels is also a critical component of a post-breach response strategy.