Safepay ransomware group lists neumerkel-gmbh.de on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: September 15, 2026

German manufacturing company targeted by Safepay ransomware group

The German manufacturing firm neumerkel-gmbh.de has been listed on the leak site associated with the Safepay ransomware group. According to an announcement published by the threat actors, the organization has been targeted in a cyberattack, leading to a claimed data breach.

Details of the Safepay claim

On September 15, 2026, the Safepay group published an official announcement on their leak site regarding neumerkel-gmbh.de. In this post, the group claims to have successfully obtained data belonging to the organization. To support their claim of a successful breach, the group has shared specific details regarding the company's operations.

The group alleges that they have leaked a total of 77 files. While the group has provided some information to validate their claim, they have not specified the exact nature of the leaked data or the total size of the stolen information. Furthermore, no ransom demand has been publicly stated in the announcement.

Information involved in the leak

The specific contents of the leaked files remain unconfirmed, as the exact nature of the data has not been explicitly defined by the attackers. However, the group has provided a screenshot that includes general information related to the company's business activities. This information includes details regarding the following areas:

• Company areas of operation
• Product portfolio
• Production processes

The listing does not specify if the data contains sensitive personal information or purely corporate documentation.

About Neumerkel GmbH

Neumerkel GmbH is a manufacturing company based in Germany. The company has a long history in the industrial sector, with its origins tracing back to 1963. It has been operating under its current name since 1994. The organization specializes in metal processing and provides various industrial manufacturing solutions.

Impact and potential risks

This incident may pose a significant risk to the organization's operational continuity. The exposure of such information could potentially lead to the disclosure of trade secrets, which are vital to a manufacturing firm's competitive advantage. Because the company operates within Germany, the leak of any personal data could result in legal sanctions under the General Data Protection Regulation (GDPR).

The Safepay group is known for employing double extortion tactics. In these types of attacks, threat actors not only encrypt a victim's systems to disrupt operations but also steal sensitive data to use as leverage. They threaten to leak this data on public forums if the ransom is not paid. This secondary pressure point means that even if an organization can restore its systems from backups, it still faces the risk of data exposure. This stolen data could be utilized for secondary attacks, such as targeted phishing campaigns against the company or its partners.

Furthermore, indirect risks may arise for the company's supply chain partners and customers. When a manufacturing entity is compromised, the interconnected nature of modern industrial supply chains means that the breach could have ripple effects throughout the network. Organizations in this sector often find it necessary to conduct a thorough review of their data security processes and supply chain protocols following such an event to mitigate potential downstream impacts.