Safepay ransomware group lists heinrich-steinhardt.de on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: April 16, 2025

Safepay claims a data breach against Heinrich Steinhardt GmbH

The ransomware group known as Safepay has officially listed the domain heinrich-steinhardt.de on its dedicated leak site. This announcement, made on April 16, 2025, constitutes a claim by the threat actor that they have successfully conducted a cyberattack against the organization and have exfiltrated data from its systems.

The listing follows a pattern often seen in modern cyber extortion campaigns, where threat actors move from initial network intrusion to the public disclosure of a victim's identity. By publishing the organization's name on a public leak platform, the group aims to exert maximum pressure on the target through psychological and reputational means.

Details of the alleged attack and claims

According to the announcement posted on the Safepay leak site, the group claims to have completed a successful operation against the German company. The group's actions appear to follow the double-extortion model, a tactic where attackers not only encrypt an organization's local data to disrupt operations but also steal sensitive information to threaten its public release.

Regarding the specific nature of the stolen information, the current situation remains uncertain. The listing names no specific data types or categories of information that have been targeted or compromised. Furthermore, the provided screenshots associated with the claim do not contain any data samples that would allow for the verification of the group's claims. Consequently, the exact volume of data, the specific file count, and the nature of the exfiltrated content remain unknown at this time.

The organization profile

Heinrich Steinhardt GmbH is a company based in Solingen, Germany. The organization specializes in the fields of metal processing and industrial manufacturing.

Analysis of the threat and potential implications

The tactics employed by the Safepay group pose significant risks to the organization. The use of double-extortion techniques is designed to threaten both the operational continuity of the business and the privacy of its data. For a company operating in the manufacturing sector, such disruptions can have cascading effects on supply chains and production schedules.

Because the organization is based in Germany, any confirmed data breach involving personal information could trigger legal obligations under the European Union's General Data Protection Regulation (GDPR). If the exfiltrated data includes information belonging to employees or customers, that data could potentially be utilized by the attackers for secondary attacks or for identity theft purposes.

The Safepay group is a relatively recent emergence in the threat landscape, having appeared in late 2024. Due to their recent activity, there is limited publicly available information regarding the group, making it difficult to draw definitive conclusions regarding their specific technical capabilities or their underlying motivations. This lack of historical data is a common challenge for threat intelligence analysts when dealing with emerging ransomware variants.

Defensive considerations for the manufacturing sector

While the specific details of this incident are still emerging, the incident highlights the ongoing risks faced by the industrial and manufacturing sectors. Organizations in this sector often manage complex supply chains and sensitive intellectual property, making them attractive targets for extortion-based attacks.

To mitigate the risks associated with such threats, organizations typically focus on several defensive pillars:

• Data protection and encryption: Implementing robust encryption for data at rest and in transit to ensure that even if exfiltration occurs, the data remains unusable to the attacker.
• Network segmentation: Isolating critical manufacturing systems from general business networks to prevent lateral movement by attackers.
• Regular monitoring: Utilizing continuous monitoring to detect unauthorized data exfiltration or unusual network activity.
• Incident response planning: Maintaining a well-tested response plan to address the legal and operational complexities that arise during a ransomware event.