Ransomware Group: SAFEPAY

VICTIM NAME: foerster-schwanau[.]de

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to a victim identified as “foerster-schwanau.de,” a website based in Germany. The attack was reported to have occurred on April 16, 2025, indicating a recent incident. The group responsible for this attack is identified as “safepay.” The leak includes no additional specific details about the activity or data compromised, and there are no publicly available images or screenshots to provide further insight into the nature of the breach.

The page indicates that no employees or third-party entities associated with the victim have been recorded, suggesting either limited internal exposure or non-disclosure of such information. The incident is part of a campaign by the “safepay” group, which is known for infostealer operations. Although no sensitive data or personally identifiable information appears publicly disclosed at this stage, the leak form provides a claim URL through a Tor site for further details. The website itself remains active, and additional technical or exploitable information is not included on the leak page.