dd-automation.ch listed by Safepay ransomware group

• Ransomware group: Safepay
• Country: Switzerland
• Sector: Technology
• Announcement date: October 5, 2026

The Safepay ransomware group has listed the Swiss technology company dd-automation.ch on its leak site, claiming that the organization has fallen victim to a data breach. This announcement, made on October 5, 2026, marks a new instance of targeted cyber activity directed at the technology sector.

The claimed attack event

According to the announcement posted by the Safepay group, the threat actors claim to have successfully gained unauthorized access to the internal systems of dd-automation.ch. The group asserts that this access allowed them to exfiltrate data from the organization's network. While the group has made this public claim on their dedicated leak site, the specific details regarding the method of entry or the exact timing of the intrusion remain unverified.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often serve as a public bulletin board where groups list organizations they have compromised. In many modern ransomware campaigns, groups employ a tactic known as double extortion. This method involves not only encrypting an organization's files to disrupt operations but also stealing sensitive data before encryption. The threat of leaking this stolen information on a public site provides the attackers with additional leverage to demand payment, as the victim faces the risk of regulatory penalties and reputational damage if the data is released.

Data involved in the claim

Regarding the specifics of the breach, the announcement provided by the Safepay group remains vague. While the group has identified the target and claimed that data was taken, they have not provided any specific details regarding the nature of the compromised information. The listing does not specify the types of files, the volume of data, or the specific categories of information that were allegedly exfiltrated.

• The listing names no data types.

The absence of specific data descriptions in the initial announcement is a common occurrence in the early stages of a ransomware leak. Without further disclosures from the threat actor, the exact scope of the information loss remains unknown.

Organization profile

The target of this claimed attack, dd-automation.ch, is a technology company based in Switzerland. Established in 1997, the organization has a long-standing presence in the industry. DD Automation specializes in several technical fields, including electrical engineering, automation systems, and conveyor technology.

Analysis and industry implications

The claim made by the Safepay group carries significant implications for the target organization. Given the group's known use of double-extortion tactics, there is a potential risk that sensitive commercial and operational data may have been compromised. For a company operating in the specialized fields of industrial automation and engineering, such a breach could pose specific risks to intellectual property and trade secrets, which are vital to maintaining a competitive advantage in the technology sector.

Furthermore, because the organization is based in Switzerland, any confirmed data breach may fall under the regulatory scope of the Federal Act on Data Protection (FADP). Such legal frameworks govern how personal data must be protected and how breaches must be reported. Beyond the immediate loss of corporate data, organizations in this sector may face secondary risks, such as the potential exposure of employee data or the possibility of subsequent supply chain attacks, where attackers use the compromised information to target the organization's partners or clients.

To defend against such threats, organizations in the technology and engineering sectors typically focus on robust security postures. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular offline backups to mitigate the impact of encryption. Additionally, monitoring for unauthorized data exfiltration and implementing zero-trust architectures can help reduce the likelihood of a successful breach. At this time, information regarding the specific capabilities and operations of the Safepay group remains limited.