Notar-gerresheim.de listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Professional Services
• Announcement date: December 17, 2025

Safepay ransomware group targets German notary office

The Safepay ransomware group has officially listed the German-based notary office notar-gerresheim.de on its dedicated leak site. According to the announcement made on December 17, 2025, the threat actors claim to have successfully gained unauthorized access to the digital assets of the institution.

The group's announcement marks a significant development in their ongoing activities, although public information regarding the specific methods or the overall operational history of the Safepay group remains limited. In such instances, ransomware groups often use leak sites to pressure victims by threatening the public disclosure of sensitive information.

Details of the claimed attack

The incident was reported on December 17, 2025, the same date the group claimed to have carried out the attack. While the listing confirms that the organization has been targeted, the group has not provided specific details regarding the nature of the breach or the volume of information involved. No specific ransom demand has been issued in the public announcement, and the group has not shared information regarding the total size of the data allegedly stolen.

Furthermore, the announcement did not include any sample files or specific details regarding the content of the allegedly leaked data. This lack of information is common in the early stages of a ransomware extortion attempt, where the primary goal is to signal to the victim that their data is indeed in the hands of the attackers.

Organization profile

The affected entity, notar-gerresheim.de, is identified as Notare Dr. Heinrich & Dr. Berg. This is a private notary office located in the Gerresheim district of Düsseldorf, Germany. The firm is responsible for providing essential notary services and legal consultancy to its clients.

Potential impact and security implications

Because the organization provides notary services, there is a possibility that the data involved in such a breach could include sensitive legal documents, property records, or wills containing personal information. The exposure of such highly sensitive documentation carries significant risks for the individuals involved, potentially making them targets for identity theft or highly targeted phishing attacks.

From a regulatory perspective, a breach of this nature involving sensitive personal data can lead to serious compliance issues and administrative sanctions under the European Union's General Data Protection Regulation (GDPR). The use of double-extortion tactics by groups like Safepay—where attackers both encrypt data and threaten to leak it—is designed to maximize pressure on the victim through the threat of reputational damage and legal repercussions.

For organizations operating in the professional services sector, maintaining robust cybersecurity postures is critical. This includes implementing multi-factor authentication, maintaining regular offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized access. Organizations must also be prepared to follow strict data breach notification protocols to comply with regional privacy laws and to mitigate the impact on their clients.