safepay ransomware group lists schoenundendres.de on its leak site

• Ransomware group: safepay
• Country: Germany
• Sector: Professional Services
• Announcement date: May 29, 2025

The ransomware group known as safepay has listed the domain schoenundendres.de on its leak site, claiming to have stolen a significant amount of data from the organization. This announcement, made on May 29, 2025, follows a claimed attack date of May 10, 2025, marking a potential major security incident for the targeted entity.

The details of the claim

According to the announcement posted on the safepay leak platform, the group claims to have successfully exfiltrated 30 GB of data belonging to the institution. In addition to the volume of the stolen information, the group's listing includes specific financial details regarding the target, stating that the institution's annual revenue is 5 million dollars. This type of information is often used by threat actors to gauge the potential success of their extortion attempts.

Ransomware leak sites serve as a public stage for cybercriminals to exert pressure on their victims. By publishing names of organizations and the volume of stolen data, these groups aim to damage the reputation of the target and coerce them into paying a ransom to prevent further exposure. This specific incident highlights the ongoing threat posed by ransomware groups that utilize public shaming as a core component of their operational model.

Data involved in the incident

While the group has provided the total volume of the alleged breach, they have not provided specific details regarding the actual content of the leaked data. The information available from the group's listing is limited to the total data size and the financial profile of the organization. Consequently, the listing names no specific data types.

The lack of granular detail regarding the file types or the specific nature of the stolen documents is a common occurrence in the early stages of a leak. However, the sheer volume of 30 GB suggests a substantial amount of information has been targeted. In many ransomware scenarios, the contents of such a breach can include sensitive corporate files, client communications, or internal administrative records, though the specific nature remains unconfirmed in this instance.

The organization profile

The target of this alleged attack is Schön & Endres, a professional services firm based in Munich, Germany. The firm operates within the legal sector, providing specialized legal advice and representation. Their primary areas of expertise include labor law, commercial law, and corporate law. Given the nature of their work, the firm handles sensitive legal matters and confidential documentation for its clients.

Analysis and industry implications

This incident indicates that the safepay group is employing double-extortion tactics. Double extortion is a strategy where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This method increases the pressure on the victim, as the threat of a data leak remains even if the organization can restore its systems from backups.

Because the institution is based in Germany, the incident is likely to fall under the scrutiny of the General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how personal data is handled and protected, and a breach of this nature may lead to significant legal proceedings and regulatory investigations. Furthermore, the publication of stolen data can create secondary risks for the organization's employees and customers, such as identity theft or the execution of targeted phishing attacks.

Regarding the group's operations, safepay emerged in late 2024 and does not appear to utilize an affiliate program. This suggests that the attacks may be managed directly by the group members themselves rather than through a distributed network of affiliates. For organizations in the professional services sector, such as law firms, the scale of a data leak can have a profound impact on operational continuity and client trust. To mitigate these risks, organizations typically focus on robust data encryption, strict access controls, and comprehensive employee training to defend against the initial stages of an attack.