Dawg-dok.de targeted by Safepay ransomware group

• Ransomware group: Safepay
• Country: Germany
• Announcement date: May 21, 2025

Safepay claims data breach at dawg-dok.de

The ransomware group known as Safepay has published a listing on its dedicated leak site targeting the German organization dawg-dok.de. According to the announcement made on May 21, 2025, the group claims to have successfully infiltrated the organization's systems and exfiltrated a significant volume of information. This incident highlights the ongoing threat posed by ransomware actors who utilize public leak sites to pressure their victims through the threat of data exposure.

The group's announcement involves a claim of a massive data theft, asserting that they have obtained a substantial archive from the target. By publishing these claims on a public platform, the group aims to maximize visibility and exert pressure on the victim organization. This tactic is a hallmark of modern ransomware operations, where the goal is not just to encrypt local files, but to weaponize the sensitive information stolen during the initial stages of the attack.

Details of the alleged theft

The Safepay group's listing provides specific details regarding the scale of the alleged breach. The group claims to have obtained 123 GB of data from the systems belonging to dawg-dok.de. This archive has reportedly been made available for download on the group's leak site, with the listing providing links intended for both viewing and downloading the alleged stolen data.

Regarding the specific contents of the stolen information, the group has not provided any detailed information regarding the nature of the leaked data. The available evidence, such as screenshots provided by the group, only indicates the existence of a 123 GB ZIP file. Consequently, the specific types of files or the exact nature of the sensitive information contained within that archive remain unconfirmed.

About dawg-dok.de

Dawg-Dok is a veterinary clinic located in Berlin, Germany. The organization provides a range of general veterinary services and healthcare solutions specifically designed for pets. As a healthcare provider for animals, the organization handles sensitive information related to its clients and their pets.

Analysis and implications of the incident

This incident, allegedly carried out by the Safepay group, suggests that the organization's data may have been compromised by unauthorized parties. The group, which emerged in late 2024 and is reported to operate without an affiliate program, appears to be utilizing double-extortion tactics. In these types of attacks, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations, threatening to leak the data if the demands are not met.

Because the organization is based in Germany, this incident may trigger data breach notification requirements under the General Data Protection Regulation (GDPR). The exposure of such data can create significant secondary risks for the organization's customers or employees, including the potential for identity theft and highly targeted phishing attacks. When personal or sensitive information is leaked, attackers often use it to craft more convincing social engineering campaigns against the individuals involved.

For organizations operating in the veterinary and healthcare sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication (MFA) across all remote access points, maintaining offline and immutable backups to ensure data can be restored without paying a ransom, and conducting regular employee training to recognize phishing attempts. Furthermore, continuous monitoring of network traffic and strict access controls can help detect and prevent unauthorized data exfiltration before it reaches the scale of a major breach.