Metten-maas.de listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: May 11, 2025

Safepay claims data breach against metten-maas.de

The ransomware group known as Safepay has officially listed the German organization metten-maas.de on its dedicated leak site. According to the announcement made by the group, they claim to have successfully exfiltrated a significant amount of data from the company's internal systems.

The listing was posted on the group's leak site on May 11, 2025. While the announcement was made in May, the group claims that the actual attack occurred much earlier, specifically on April 4, 2025. This discrepancy between the date of the breach and the date of the public announcement is a common occurrence in ransomware operations, where threat actors may spend weeks or months conducting reconnaissance or attempting to negotiate before moving to public exposure.

Details of the alleged data theft

Regarding the specifics of the stolen information, the Safepay group has provided limited details. The group claims to be in possession of a dataset totaling 43 GB. Despite the significant size of the alleged data, there is no detailed information regarding the specific content or the types of files that were taken during the intrusion.

The listing does not specify the exact nature of the files, and the group has not provided any information regarding a ransom demand or the specific number of files involved. However, the announcement does include an estimated figure concerning the annual revenue of the organization, which is often used by ransomware groups to calculate potential extortion demands.

Data characteristics

• Total claimed data size: 43 GB

The listing names no specific data types or categories of information that were allegedly compromised.

About metten-maas.de

Metten Fleischwaren is a family-owned company based in Finnentrop, Germany. The organization specializes in the production of meat and delicatessen products. They are recognized as experts in high-quality meat goods and provide various ready-to-eat meal solutions for their customers.

Analysis and potential implications

This alleged leak poses significant risks to the operational continuity of the organization. Because the specific content of the 43 GB dataset remains ambiguous, there is a high possibility that sensitive personal or commercial information has been exposed. For a company operating within Germany, such a breach carries the potential for severe legal consequences under the General Data Protection Regulation (GDPR), which mandates strict protections for personal data and requires timely reporting of breaches.

The involvement of the Safepay group is particularly concerning due to their use of double extortion tactics. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. This method allows the group to threaten the victim with the public release of their data if the ransom is not paid, thereby increasing the pressure on the target.

Furthermore, the emergence of the Safepay group in late 2024 suggests that their activities may still be in an observational phase, as they continue to refine their methods and target selection. Organizations in the manufacturing sector should remain vigilant against such threats. To mitigate the risks associated with ransomware, companies often implement defensive measures such as robust backup strategies, multi-factor authentication, network segmentation, and continuous monitoring of their digital environments to detect unauthorized access attempts early.