Ransomware Group: SAFEPAY

VICTIM NAME: mcsl[.]de

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak involves the victim domain “mcsl.de,” which is situated in Germany and operates within the technology sector. The attack was publicly disclosed on June 14, 2025, and the compromise occurred around the same time. The threat actor group responsible is identified as “safepay.” The leak page features a screenshot depicting internal documents or data, though specific details have been redacted for privacy and security reasons. No personally identifiable information about multiple individuals or employees is reported, indicating that employee data was not exposed or was not present at the time of the breach.

The incident is characterized by the presence of a data leak or ransom negotiation platform accessible via a Tor link, suggesting that sensitive or possibly proprietary information has been compromised. The data available does not specify the exact nature or scope of the leak, but the existence of download links or leaked files is implied. The site does not contain any explicit personal or confidential information, aligning with best practices for professional reporting and privacy standards. Additional contextual information includes the use of an AI-generated description, which indicates a lack of detailed concrete data at this stage.