pau.at listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Austria
• Announcement date: December 29, 2025

Austrian architectural firm targeted by safepay ransomware group

The Austria-based architectural firm pau.at has been listed on the leak site of the ransomware group known as safepay. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack, marking a new instance of data extortion involving a regional professional practice.

Details of the alleged attack

The safepay group officially announced the ransomware incident involving pau.at by listing the organization on its dedicated leak site on December 29, 2025. While the announcement appeared on the leak site at the end of the year, the group claims that the actual attack on the organization took place on December 21, 2025.

The group claims to have successfully obtained the organization's data. By publishing the name of the victim on their platform, the attackers aim to exert pressure through double extortion tactics. In a typical double extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to threaten the victim with the public release of that data unless a ransom is paid. This method significantly increases the pressure on the target, as the threat of a data leak can cause lasting damage to reputation and legal standing.

Data involved in the incident

Regarding the specific contents of the alleged breach, no details or sample files regarding the nature of the allegedly leaked data have been provided by the threat actors.

About pau.at

PAUAT Architekten is a regional architectural practice based in Wels, Austria. The firm was founded in 1999 by architect Heinz Plöderl.

Impact and security implications

The alleged leak may cause significant damage to the organization's operational processes and commercial reputation. Because the organization operates within Austria, the presence of personal data in the leak could lead to various legal obligations under the General Data Protection Regulation (GDPR). The use of double extortion tactics by the safepay group may increase the risk of the organization's data being published or sold on the dark web.

Furthermore, the disclosure of sensitive information, such as architectural projects and client details, could facilitate targeted phishing attacks against third parties. When attackers gain access to specific project details, they can craft highly convincing social engineering campaigns against clients or partners who believe the communication is legitimate. This secondary risk is a common consequence of modern ransomware attacks.

The safepay group, which emerged in late 2024, remains a relatively new entity with limited public information available regarding its specific methods and infrastructure. For organizations operating in professional services, maintaining robust defensive measures is critical. This typically includes implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing and unauthorized access.