Safepay ransomware group lists wohnverbund-st-gertrud.de on its leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Healthcare
• Announcement date: January 19, 2026

Safepay claims data breach at Wohnverbund St. Gertrud

The Safepay ransomware group has listed the German social care organization Wohnverbund St. Gertrud on its leak site. According to an announcement published by the group, the organization has been targeted in a cyberattack, with the threat actors claiming to have obtained data belonging to the entity.

The announcement was made on January 19, 2026, which also matches the date the group claims the attack occurred. While the post confirms the group's intent to leverage the incident, it does not provide specific details regarding the scale of the operation or the financial demands being made by the attackers.

Details of the claim

The information provided by the Safepay group is currently limited in scope. The group's announcement contains general information regarding the operations of Wohnverbund St. Gertrud, but it lacks specific technical or financial details. Specifically, the listing does not disclose a ransom demand, nor does it provide information regarding the total volume of data stolen or the specific file count involved in the incident.

The nature or content of the allegedly exfiltrated data is not specified in the provided screenshot or registration records. The listing names no specific data types that have been compromised.

About Wohnverbund St. Gertrud

Wohnverbund St. Gertrud is a social care and residential support organization based in Morsbach, Germany. The organization plays a critical role in the local community by providing living and care services specifically designed for individuals with disabilities.

Risk assessment and implications

The tactics employed by the Safepay group suggest a reliance on double-extortion methods. In such scenarios, threat actors not only encrypt an organization's systems but also steal sensitive information to use as leverage, threatening to leak the data on public forums if a ransom is not paid. This approach places the organization's sensitive data at significant risk of public exposure.

Given that the entity provides social care and residential support, it is possible that the compromised data includes private health or personal information. Such a breach could lead to significant compliance issues and administrative penalties under the European Union's General Data Protection Regulation (GDPR). Beyond the immediate regulatory risks, secondary consequences may arise, such as identity theft or targeted phishing attacks directed at the individuals served by the organization.

Public information regarding the Safepay group remains limited. In general, organizations operating in the healthcare and social care sectors can mitigate these risks by implementing robust data protection frameworks, maintaining strict access controls, and ensuring comprehensive monitoring of their networks to detect unauthorized data exfiltration early.