Safepay ransomware group lists jansen-aschendorf.de on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: July 1, 2025

Safepay claims data breach against Jansen Aschendorf

The ransomware group known as Safepay has listed the German organization jansen-aschendorf.de on its leak site. According to the group's announcement, they claim to have successfully compromised the organization's data and are in possession of a significant dataset.

The listing, which appeared on July 1, 2025, marks a new development in the group's activities. Safepay has asserted that the breach occurred on the same day the announcement was made, July 1, 2025. While the group has publicly identified the target, specific details regarding the nature of the attack or the exact method of entry remain undisclosed in the initial leak site posting.

Details of the claimed theft

The Safepay group has made several specific claims regarding the scale of the incident. According to the group's announcement, the volume of the allegedly stolen information is quite substantial. The group claims to possess a dataset totaling 119 GB. This volume of data suggests a significant breach of the organization's digital infrastructure.

In addition to the data size, the group's listing included financial information regarding the target. The announcement mentions that the organization has an annual revenue of $30 million. This information is often used by ransomware groups to establish a baseline for their ransom demands, although no specific ransom demand has been stated in this particular listing.

Regarding the specific content of the files, the listing names no specific data types or categories of information that have been compromised.

The target organization

The victim, Jansen Aschendorf, is a manufacturing company based in Germany. The organization specializes in metal processing and industrial manufacturing solutions. Their core business operations include steel construction and the production of various metal parts. As a company operating within the manufacturing sector, they provide specialized industrial solutions to their clients.

Risk assessment and industry implications

The Safepay group is known to employ a double-extortion strategy. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data and threaten to leak it publicly if a ransom is not paid. This dual approach significantly increases the pressure on the victim, as the threat of data exposure can lead to severe operational and reputational damage.

For a German-based company like Jansen Aschendorf, a confirmed data breach could trigger significant legal consequences. Under the General Data Protection Regulation (GDPR), organizations are subject to strict notification obligations and potential legal sanctions if personal data is compromised. Furthermore, because the company operates in the manufacturing sector, there is an inherent risk that the leaked data could include intellectual property or sensitive trade secrets, which are vital to maintaining a competitive advantage in industrial markets.

If the stolen data contains information related to employees or customers, the organization and the individuals affected may face risks such as identity theft or targeted phishing attacks. These secondary attacks often follow a primary breach, as criminals use the stolen information to craft highly convincing fraudulent communications.

The Safepay group itself is a relatively new entity in the threat landscape, having emerged in late 2024. Consequently, public information regarding their specific tactics, techniques, and procedures remains limited. Organizations in the manufacturing sector often face these types of threats and can mitigate risks by implementing robust security frameworks, maintaining regular backups, and ensuring strict compliance with data protection regulations to safeguard their intellectual property and customer trust.