Safepay ransomware group lists freudenberg-cranes.com on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: May 16, 2025

Safepay claims data breach against Freudenberg Cranes

The ransomware group known as Safepay has listed the German manufacturing entity freudenberg-cranes.com on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated a significant amount of data belonging to the organization.

This incident follows a pattern observed in modern cyberattacks where threat actors target specific industrial sectors to maximize their leverage. By publishing the name of the victim on a public leak platform, ransomware groups aim to exert pressure on the targeted organization to meet their demands, a tactic often associated with high-stakes extortion campaigns.

Details of the alleged attack

The announcement regarding the breach was made on May 16, 2025. The Safepay group claims that the attack occurred on the same day the listing was published. In their public statement, the group provided specific financial context regarding the victim, stating that the organization's annual revenue is under 5 million dollars.

Ransomware leak sites serve as a primary tool for extortion. These platforms are used by cybercriminals to shame organizations and demonstrate their capability to breach secure networks. When a group lists a company, it often serves as a warning to others and a direct method of public pressure against the victimized entity.

Data involved in the incident

Regarding the specific content of the breach, the group has not provided detailed information concerning the nature of the stolen files. The available information is limited to the volume of the data claimed to be in their possession.

• Total claimed data size: 48 GB

The listing does not specify the file types or the exact categories of information contained within the 48 GB dataset. The group has provided no further details regarding the specific contents of the alleged leak.

About Freudenberg Cranes

Freudenberg Cranes is a German-based company that operates within the manufacturing sector. The organization specializes in the design, manufacturing, and maintenance of industrial crane systems and lifting equipment. Their service portfolio includes providing customized crane solutions specifically designed for heavy industrial applications.

Analysis and potential implications

The Safepay group is known for employing a double-extortion strategy. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to threaten its public release. This dual approach significantly increases the pressure on a company, as they face both operational downtime and the risk of permanent reputational damage.

Because the affected entity is based in Germany, this incident may trigger specific legal obligations. Under the General Data Protection Regulation (GDPR), organizations are required to notify relevant authorities and, in certain circumstances, the affected individuals if a data breach poses a risk to their rights and freedoms. The potential leak of sensitive information could lead to significant regulatory scrutiny.

Furthermore, if the stolen data contains proprietary trade secrets or employee information, the organization may face increased risks from third parties. This includes the possibility of targeted phishing attacks where attackers use stolen details to impersonate legitimate contacts or officials to deceive employees or clients.

The operational structure of Safepay is noteworthy. Having emerged in late 2024, the group does not appear to utilize an affiliate program, which suggests a more centralized or distinct operational model compared to other ransomware-as-a-service operations. For organizations in the manufacturing sector, such threats highlight the importance of robust data protection measures, including regular backups, network segmentation, and comprehensive employee training to mitigate the risks of both data exfiltration and unauthorized access.