Schapmann listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Manufacturing
• Announcement date: May 6, 2025

Safepay claims data breach at Schapmann

The Safepay ransomware group has officially listed the German organization Schapmann on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully gained unauthorized access to the company's internal systems. This listing serves as a public claim by the group regarding a successful cyberattack against the manufacturing entity.

The announcement was published on May 6, 2025. In the post, the Safepay group asserts that the breach occurred much earlier than the public disclosure, specifically claiming that the attack took place on April 11, 2025. By publishing the organization's name on their leak site, the group aims to pressure the victim, a tactic commonly associated with modern ransomware operations.

Details of the alleged data theft

Regarding the specifics of the stolen information, the group has provided limited details. While the announcement confirms the scale of the breach, it does not offer a granular breakdown of the specific files or categories of information that were targeted. The listing primarily focuses on the volume of the data rather than its specific content.

Data characteristics

• Total claimed data size: 70 GB

The group has not provided any information regarding the specific file types or the exact nature of the documents contained within the 70 GB of data. The available evidence provided by the group, such as screenshots, appears to only display the total size of the data and the name of the affected organization, leaving the specific contents of the breach unverified and undisclosed.

About Schapmann

Schapmann is an engineering and manufacturing company based in Germany. The organization specializes in industrial production and metal processing, playing a role in the specialized manufacturing sector. Given its focus on industrial production and metal processing, the company operates within a highly technical and specialized industrial environment.

Analysis and potential impact

The Safepay group is known for utilizing the double-extortion method. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the data publicly, the group attempts to force the victim into paying a ransom to prevent the disclosure of proprietary or sensitive information.

The potential consequences of this alleged breach are multifaceted. Because Schapmann is based in Germany, the incident may trigger significant legal obligations and sanctions under the General Data Protection Regulation (GDPR), particularly regarding mandatory notification requirements in the event of a confirmed data breach. Furthermore, the public disclosure of such data can lead to secondary risks, including identity theft or the execution of highly targeted phishing attacks aimed at the organization's employees and business partners.

From an operational standpoint, the theft of 70 GB of data could pose a significant threat to the organization's continuity. In the manufacturing sector, the exposure of such data often carries the risk of leaking trade secrets or sensitive information related to the supply chain. Such information is vital for maintaining a competitive advantage and ensuring the security of industrial processes.

It is also worth noting the operational profile of the Safepay group. The group has been active since late 2024 and does not appear to utilize an affiliate program, which suggests that these attacks may be managed directly by the core members of the group rather than through a distributed network of partners.

Defensive considerations for the manufacturing sector

Organizations operating in the manufacturing and engineering sectors face unique risks due to the high value of their intellectual property and supply chain data. To mitigate the risks associated with ransomware and data exfiltration, companies often implement several defensive strategies:

• Network Segmentation: Isolating industrial control systems from corporate networks to prevent lateral movement by attackers.
• Robust Access Controls: Implementing strict identity and access management to ensure only authorized personnel can reach sensitive production data.
• Continuous Monitoring: Utilizing security monitoring to detect unauthorized access or large-scale data transfers in real-time.
• Data Encryption: Protecting sensitive files both at rest and in transit to render stolen data useless to attackers.