safepay ransomware group lists lipcare.de on its leak site

• Ransomware group: safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: August 29, 2025

The Germany-based cosmetics manufacturer lipcare.de has been listed on the leak site of the safepay ransomware group. The group claims to have carried out a ransomware attack against the entity, alleging that they have successfully compromised the institution's data.

The claimed attack event

According to the announcement made on the safepay leak site on August 29, 2025, the group claims to have targeted lipcare.de. While the listing was published in late August, the group associates these claims with an event that allegedly occurred on June 20, 2025. This gap between the claimed intrusion and the public announcement is a common occurrence in ransomware operations, where attackers may take time to exfiltrate data or negotiate before moving to public pressure tactics.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By publishing the names of organizations they have targeted, these groups aim to damage the victim's reputation and force them into paying a ransom to prevent the release of sensitive information. This method is a core component of modern cyber extortion campaigns.

Data involved in the incident

The announcement provided by the safepay group does not provide specific details regarding the nature of the data allegedly compromised. The listing names no specific data types or categories of information that were targeted during the claimed attack.

Organization profile

Lipcare is a manufacturer based in Germany and is operated by KHK GmbH. The company specializes in production activities within the personal care and cosmetics sector. Their business model focuses on the manufacturing of both natural and conventional cosmetic products, serving the broader personal care market.

Analysis and potential implications

This situation may cause disruptions to the institution's operational continuity. When a manufacturing entity is targeted by ransomware, the resulting technical disruptions can halt production lines and interfere with supply chain logistics. Furthermore, if the compromised data includes employee or customer information, legal sanctions and administrative processes under the General Data Protection Regulation (GDPR) may be triggered.

The safepay group is known to employ a double-extortion method. In a double-extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data before the encryption occurs. The primary goal is to threaten the victim with the public release of this data, creating secondary risks such as identity theft or targeted phishing attacks against the organization's stakeholders. The threat of data exposure adds a layer of reputational risk that is often more difficult to manage than the technical recovery from the encryption itself.

Additionally, security risks may arise for the institution's supply chain partners. In the manufacturing sector, interconnected digital ecosystems mean that a breach in one company can potentially expose vulnerabilities or data within the networks of its partners. Organizations in this sector can mitigate such risks by implementing robust identity and access management, maintaining rigorous patch management schedules, and conducting regular audits of third-party connections.

It is noted that the safepay group emerged in late 2024 and does not operate an affiliate program. This lack of an affiliate program suggests a more centralized operational structure compared to other ransomware-as-a-service (RaaS) models where various affiliates carry out attacks on behalf of a central developer.

Defensive considerations for organizations

To defend against such threats, organizations typically focus on multi-layered security strategies. This includes maintaining offline, immutable backups to ensure recovery in the event of encryption, and implementing strict network segmentation to prevent lateral movement by attackers. Continuous monitoring and rapid incident response capabilities are also essential to detect and contain breaches before significant data exfiltration can occur.