Peus-muenzen.de listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Retail & E-Commerce
• Announcement date: December 19, 2025

Safepay claims a data breach against peus-muenzen.de

The Safepay ransomware group has officially listed the German organization peus-muenzen.de on its dedicated leak site. Through this announcement, the threat actor group alleges that it has successfully executed a data breach against the entity. This development marks a significant escalation in the threat landscape facing the organization, as the group's presence on a leak site typically signals a move toward publicizing stolen information to exert pressure.

The incident was announced on December 19, 2025, with the group claiming that the attack occurred on the same day. While the listing has been made public, the specific circumstances surrounding the initial unauthorized access remain unclear. The publication of such a listing often implies that the target's operational processes may have been disrupted by the intrusion, potentially affecting the entity's ability to conduct business as usual.

Details regarding the alleged data breach

At this stage of the incident, the Safepay group has not provided specific details or sample files regarding the nature of the allegedly leaked data. There is no information available concerning the total volume of files or the specific size of the data set involved in the claim. Furthermore, the group has not issued a ransom demand or specified the exact contents of the breach in their public announcement.

The listing names no specific data types or individual records that have been targeted or exfiltrated. Because the group has not released any evidence or specific file samples, the exact scope of the compromised information remains unknown to the public.

About peus-muenzen.de

Dr. Busso Peus Nachfolger is one of Germany's oldest and most prestigious numismatic firms. The company specializes in the trade of rare coins, medals, and historical currency, as well as providing auction services. Given its long-standing history and specialized market position, the firm maintains a significant reputation within the numismatic sector.

Analysis and potential implications

The Safepay group is known to employ a double-extortion strategy. This method involves both encrypting an organization's data to disrupt operations and stealing sensitive information to threaten its public release. Because of this tactic, there is a possibility that customer and operational data may have been compromised in this instance. For a prestigious firm like peus-muenzen.de, such a breach could have negative implications for its commercial reputation.

From a regulatory perspective, this incident could trigger data breach notification obligations under the General Data Protection Regulation (GDPR) in Germany, where the entity is based. For the individuals potentially affected, secondary risks may emerge, such as identity theft or targeted phishing attacks. The emergence of such threats often necessitates heightened vigilance from both the organization and its clients.

Regarding the threat actor, while Safepay is known to have emerged in late 2024, public information regarding its operational capacity and specific motivations remains limited. Organizations in the retail and e-commerce sectors, particularly those handling high-value assets or sensitive client collections, should consider robust defensive measures to mitigate these risks. Common defensive strategies include implementing strict access controls, maintaining offline backups, and conducting regular security audits to detect unauthorized access before data can be exfiltrated.