Schuhbode.de listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Germany
• Sector: Retail & E-Commerce
• Announcement date: March 30, 2025

Safepay claims data breach at schuhbode.de

The Safepay ransomware group has listed the German footwear retailer schuhbode.de on its dedicated leak site. In an announcement posted on March 30, 2025, the threat actor group claimed to have successfully exfiltrated data belonging to the organization. This development follows an alleged attack date of March 5, 2025, according to the group's public posting.

The threat actor group is utilizing a double-extortion strategy in this instance. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information prior to encryption. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom demands are not met, thereby increasing the pressure on the victim to pay.

Details of the group's claims

According to the announcement published by Safepay, the group has targeted a company with a significant financial footprint, claiming that the organization generates $5 million in revenue. The group asserts that they have successfully compromised a substantial amount of information during their operation.

The group's post focuses on the scale of the theft to maximize leverage. By highlighting the revenue of the target, the attackers aim to demonstrate that the victim has the financial capacity to pay a ransom. However, while the group has made specific claims regarding the financial status of the target and the volume of the stolen information, they have not provided specific details regarding the nature of the compromised data.

Data volume and content

The information provided by the threat actor indicates the following regarding the alleged breach:

• The claimed size of the compromised data is 74 GB.

The listing names no specific data types or categories of information that were allegedly stolen.

About schuhbode.de

Schuhbode is a footwear retailer based in Germany. It operates as an e-commerce platform that sells various brands of footwear products to its customers.

Analysis and potential impact

This claim indicates a significant risk of exposure for customer or employee data. Because the organization operates within Germany, any potential data breach could lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). The use of the double-extortion method poses a severe threat to the organization's operational continuity and could result in the leaked data being used for identity theft or targeted phishing attacks against individuals.

Information regarding the Safepay group remains limited, as the group only emerged in late 2024. Consequently, the accuracy of the data claims and the group's post-attack behavior remain uncertain. In such scenarios, it is difficult to verify whether the data presented by the attackers is authentic or if the group is exaggerating the impact of the breach.

For organizations operating in the retail and e-commerce sectors, these types of threats highlight the necessity of robust cybersecurity frameworks. To mitigate the risks associated with ransomware and data exfiltration, organizations typically focus on several defensive layers. This includes maintaining rigorous backup protocols, implementing strict access controls, and ensuring that all software and systems are regularly patched to close vulnerabilities. Furthermore, monitoring for unusual data transfers can help detect exfiltration attempts before large volumes of data are moved off the network. Given the evolving nature of ransomware groups, continuous monitoring and a proactive security posture are essential for maintaining operational integrity and protecting sensitive stakeholder information.