Steuerberater-scheerer.de listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Germany
• Sector: Professional Services
• Announcement date: December 5, 2025

Safepay claims attack on German tax firm

The threat actor known as safepay has announced the listing of the German organization steuerberater-scheerer.de on its dedicated leak site. This announcement, made on December 5, 2025, marks a potential data breach involving the professional services firm. While the listing has been posted, the group has not provided specific details regarding the volume of data taken or a specific ransom demand at this time.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims through public exposure. These sites are often used by threat actors to shame organizations into paying ransoms by threatening to release sensitive information. In this instance, the safepay group claims to have successfully gained access to the internal systems of the firm, posing a direct threat to the confidentiality of the organization's digital environment.

Details of the claimed incident

According to the announcement made by safepay, the group claims to have infiltrated the systems of steuerberater-scheerer.de. The threat actor has issued a warning that data belonging to the firm may be published on their leak site. This type of announcement is a common tactic used to signal that a breach has occurred and that the attackers have successfully exfiltrated information from the target's network.

Despite the claim of system access, the group has not provided a specific file list or any sample data to substantiate the breach. Furthermore, no information was provided regarding the total size of the data or the specific types of files that were allegedly accessed. The announcement currently remains limited to general information regarding the firm's operations and the claim of unauthorized access.

Organization profile

Steuerberater-scheerer.de operates as C. M. Scheerer GmbH and is a tax consulting and auditing firm located in Schweinfurt, Germany. The company provides professional services to both individual and corporate clients. Their expertise is focused on the specialized fields of tax law and financial auditing, making them a provider of highly sensitive financial and legal documentation.

Potential risks and industry implications

The situation involving steuerberater-scheerer.de may pose a significant risk of disclosure for financial and personal data belonging to the firm's clients. Because the firm is based in Germany, any confirmed data breach could lead to investigations by regulatory bodies under the General Data Protection Regulation (GDPR). The sensitive nature of tax and auditing services means that the data handled by the firm is often highly confidential.

The safepay group appears to be employing the double-extortion method. In a double-extortion scenario, attackers not only encrypt the victim's data to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations. This method increases the risk to the organization and its clients, as it exposes them to potential identity theft or highly targeted phishing attacks using the stolen information.

Given the firm's role in tax consulting, the sensitivity of the data involved could be high, potentially triggering broader supply chain risks. For organizations in the professional services sector, maintaining robust cybersecurity defenses is critical to protecting client trust and regulatory compliance. Common defensive steps for such organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.

• No specific data types were named in the listing.