Safepay ransomware group lists meyer-lift.de on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: December 19, 2025

The German equipment rental company Meyer Lift GmbH has been listed on the leak site of the Safepay ransomware group. The announcement, made on December 19, 2025, involves a claim of a data breach against the organization.

The alleged incident

According to the claim made by the Safepay group, the organization was targeted in an attack that allegedly resulted in a data breach. The group posted the company's information on its dedicated leak site on December 19, 2025. In the announcement, the threat actors shared information regarding the operations of Meyer Lift GmbH and indicated that the data could be published.

The listing serves as a warning that the company's digital assets may be under threat. Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release stolen information. These sites often serve as a public gallery of successful attacks, increasing the pressure on the targeted entity through reputational damage.

Data involved in the claim

Regarding the specific nature of the information allegedly stolen during the incident, the group has not provided any details or sample files. The listing does not specify what types of data were compromised or the volume of the information involved.

• No specific data types were named in the listing.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. This method involves not only encrypting a victim's files to disrupt operations but also stealing sensitive data before the encryption occurs. The goal is to threaten the victim with the public release of this data if the ransom is not paid, thereby creating a secondary layer of leverage that targets the organization's compliance obligations and reputation.

Organization profile

Meyer Lift GmbH is an equipment rental company headquartered in Hohenwestedt, located in northern Germany. The company specializes in the rental of various industrial and construction equipment, serving the manufacturing and construction sectors.

Risk assessment and implications

The involvement of the Safepay group suggests a significant risk of sensitive data exposure for the company. Because Meyer Lift GmbH is based in Germany, any confirmed data breach could lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how organizations must protect personal information and how they must respond when a breach occurs.

Furthermore, the employees and customers of the organization may face various risks, including the potential for identity theft or being targeted by sophisticated phishing attacks. When personal or corporate data is leaked, attackers often use it to craft highly convincing social engineering campaigns to deceive individuals within the supply chain or the customer base.

The Safepay group is a relatively recent emergence, having appeared in late 2024. Because the group has not been active for a long duration, its specific operational methods and tactics may not yet be fully analyzed by the broader cybersecurity community, which may contribute to a high level of threat severity. Organizations operating in the manufacturing and equipment rental sectors often face these threats and can take steps to mitigate risks, such as implementing robust backup solutions, maintaining strict access controls, and conducting regular security awareness training to defend against the evolving methods of emerging ransomware groups.