Safepay ransomware group lists SETEX-Textil GmbH on leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: December 29, 2025

Safepay ransomware group targets German manufacturer

The Safepay ransomware group has listed the German textile manufacturer SETEX-Textil GmbH on its leak site. The announcement, which appeared on December 29, 2025, indicates that the threat actor group claims to have gained access to the organization's operational and corporate data.

Details of the claimed attack

According to the announcement made on the group's platform, the domain setex-textil.de was listed on December 29, 2025. The Safepay group asserts that they have successfully breached the organization and obtained access to various internal datasets. While the group has published information regarding the company's general business activities, they have not provided specific details regarding the actual content of the alleged leak.

Ransomware groups often use leak sites to pressure victims into paying ransoms. This process typically involves a transition from the initial encryption of systems to the threat of public disclosure. In many modern cyberattacks, threat actors employ double-extortion tactics, where they not only encrypt the victim's data but also steal sensitive information to use as leverage during negotiations.

Data involved in the incident

Regarding the specific information that has been allegedly compromised, the listing names no data types or specific categories of information.

About SETEX-Textil GmbH

SETEX-Textil GmbH is a vertically integrated German textile manufacturer. The company specializes in the production and development of technical textiles and home textile products.

Risk assessment and implications

Given the Safepay group's use of double-extortion tactics, there is a significant risk that the organization's sensitive data may be published on the dark web. Because the company is based in Germany, a potential data breach could trigger legal sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR).

The disclosure of sensitive information, such as employee data or trade secrets, could cause substantial harm to the organization's operational processes and its reputation within the market. Furthermore, there is a possibility that any leaked data could be exploited for secondary risks, including identity theft or targeted phishing attacks against the company or its partners.

In the manufacturing sector, maintaining the integrity of technical specifications and supply chain information is critical. When organizations face such threats, general defensive measures often include implementing robust access controls, maintaining offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized access. Public information regarding the specific methodologies of the Safepay group remains limited.