Safepay claims to have stolen data from sb-p.de

• Ransomware group: safepay
• Country: Germany
• Announcement date: May 21, 2025

The ransomware group known as safepay has listed the German-based organization sb-p.de on its leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant volume of data from the entity.

Details of the claim

The safepay group officially added sb-p.de to its leak site on May 21, 2025. Through this announcement, the group claims to have obtained 452 GB of data. In addition to the data volume, the group has made a specific claim regarding the financial standing of the target, noting an alleged annual revenue of $5 million for the entity. This type of public shaming is a hallmark of the double-extortion strategy frequently utilized by modern ransomware actors. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage, threatening to release the data publicly unless a ransom is paid.

Data involved in the incident

Regarding the specific contents of the breach, the group has provided limited information. While the volume of the stolen information is specified, the listing names no specific data types or details regarding the nature of the files obtained. The available information is limited to the following:

• Claimed data volume: 452 GB

Organization profile

SB-P is a payment services and financial technology company based in Germany. The organization provides payment systems and financial solutions for businesses.

Analysis and potential implications

This leak claim may pose significant risks to the organization's operational continuity and data privacy. Because the entity is based in Germany, the potential exposure of personal data could lead to serious legal consequences under the General Data Protection Regulation (GDPR). The use of double-extortion tactics by the safepay group may result in lasting reputational damage and expose the organization to secondary risks, such as targeted phishing attacks against the company or its clients.

It is worth noting that the safepay group emerged in late 2024, and as a result, its operational patterns and specific methodologies may still be evolving. For organizations facing such threats, it is generally advisable to fulfill all necessary data breach notification requirements to comply with regulatory standards. Furthermore, conducting a comprehensive security audit of all internal systems is a critical step in identifying vulnerabilities and strengthening defenses against future incursions.

Ransomware leak sites serve as a platform for threat actors to exert pressure on victims. By publishing names and data sizes, these groups attempt to maximize the visibility of the breach to increase the likelihood of a payout. When a group targets a financial technology provider, the stakes are often higher due to the sensitive nature of payment systems and the regulatory oversight governing the sector. Organizations in this space must maintain robust incident response plans to mitigate the impact of both data exfiltration and operational downtime.