Safepay ransomware group lists reichenau.at on its leak site

• Ransomware group: Safepay
• Country: Austria
• Announcement date: September 8, 2026

The Safepay ransomware group claims a breach of reichenau.at

The Safepay ransomware group has listed the digital platform of the Reichenau an der Rax municipality in Austria on its dedicated leak site. According to the announcement made on September 8, 2026, the threat actor claims to have successfully obtained data from the municipality's digital service platform.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. In these scenarios, threat actors often publish information about the targeted organization to shame them into paying a ransom. This tactic is a hallmark of modern cyber extortion, where the goal is not just to encrypt systems, but to threaten the public release of sensitive information to maximize leverage over the victim.

Details of the claimed attack

The threat actor known as Safepay listed the domain reichenau.at on its leak portal on September 8, 2026. The group claims to have targeted the digital service platform used by the municipality. The announcement provided by the group includes general information regarding the institution's administrative structure and the public services it provides, though it does not confirm the specific method of entry.

Regarding the specific contents of the alleged breach, no specific details regarding the nature of the allegedly leaked data have been provided by the group. The listing does not specify the volume of data or the number of files involved.

About the Reichenau an der Rax municipality

Reichenau an der Rax is a municipality located in the state of Lower Austria, Austria. The institution's official website serves as a central digital information and service platform for residents, businesses, and visitors within the region.

Potential impact and security implications

This incident may represent a potential cyber threat against public institutions. The disruption of digital services provided to citizens or the exposure of public data could negatively impact local government operations. As the institution operates in Austria, potential violations of data protection obligations under the General Data Protection Regulation (GDPR) may be considered.

Given that the Safepay group is known to employ double extortion tactics, both the operational continuity and data privacy of the institution may be at risk. Double extortion is a method where attackers not only encrypt an organization's data to halt operations but also steal sensitive information to threaten its public release. This dual-threat approach increases the pressure on organizations to comply with ransom demands.

Secondary risks associated with such breaches may include the potential use of leaked data for identity theft or targeted phishing attacks. When public sector data is compromised, the information can be repurposed by malicious actors to conduct highly convincing social engineering campaigns against citizens or employees.

For organizations in the public sector, maintaining robust cybersecurity postures is essential. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. Furthermore, ensuring strict adherence to data protection frameworks helps mitigate the legal and operational consequences of a potential breach.