Safepay ransomware group lists frapack.de on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: April 16, 2025

Safepay claims data breach against Frapack

The Safepay ransomware group has officially listed the German organization frapack.de on its dedicated leak site. This announcement, made on April 16, 2025, includes an allegation that the threat actor group has successfully gained unauthorized access to the organization's internal data. This development marks a significant escalation in the cyberattack against the company, as the group has moved from initial intrusion to publicizing the victim on their platform.

The listing serves as a public claim of a successful breach. In the landscape of modern cybercrime, such announcements are often used as a tool for pressure. The group's decision to publish the organization's name on a leak site is a hallmark of their operational methodology, signaling that the target is now under the threat of public exposure.

Details of the claimed attack

According to the announcement published on the Safepay leak site, the group claims to have accessed the data belonging to frapack.de. However, specific technical details regarding the nature of the breach remain undisclosed by the attackers. At this stage, there is no information regarding the specific volume of data taken or the total number of files involved in the incident.

Regarding the content of the breach, the listing provides no information regarding the nature of the leaked or threatened data. Furthermore, the associated screenshot provided by the group does not offer any content details that would allow for a precise assessment of what was compromised. The listing names no specific data types.

About Frapack

Frapack is a Germany-based supplier of packaging materials. The company provides industrial packaging solutions, shipping supplies, and logistics equipment. As an entity operating within the manufacturing and logistics supply chain, the organization plays a role in providing essential materials for industrial operations.

Risks and implications for the manufacturing sector

The Safepay group's adoption of double extortion tactics introduces significant risks for the targeted organization. Double extortion is a method where attackers not only encrypt an organization's systems but also steal sensitive information, threatening to leak or sell it to third parties if a ransom is not paid. This tactic significantly increases the pressure on a victim, as the threat of data publication can lead to severe consequences even if the organization can restore its systems from backups.

For a German-based organization like Frapack, a potential data breach carries heavy regulatory implications. Under the European Union's General Data Protection Regulation (GDPR), organizations are required to protect personal data, and failures in data security can lead to legal sanctions and administrative fines. Beyond legal repercussions, the organization may face operational disruptions and substantial reputational damage. Depending on the specific type of data that might be leaked, secondary risks such as identity theft or targeted phishing attacks against employees or customers may also be observed.

The Safepay group, which emerged in late 2024, represents an evolving threat in the cybercrime ecosystem. Their activities may pose a threat to other organizations within the manufacturing sector. To mitigate such risks, organizations in this sector often focus on robust security frameworks, including regular data backups, network segmentation, and continuous monitoring of their digital environment. Protecting the integrity of the supply chain is a critical priority for manufacturing entities facing these types of sophisticated extortion threats.