VULNpocalypse
LowBreach / campaignMonitoring

SafePay ransomware group claims ehrenwall.de on its leak site

RansomLook reports the SafePay ransomware group listed ehrenwall.de on its leak site; the claim is unverified, so watch for an official statement.

Published
Exploitation
No, only a leak-site claim reported by RansomLook, not confirmed by the victim

What happened

According to RansomLook, the SafePay ransomware group claimed ehrenwall.de on its leak site. RansomLook reported this on 2026-11-04.

A leak-site listing is a claim by the group, not proof of a breach. The victim has not confirmed it, and no independent outlet has verified it. The entry point, any data involved and the scope are not confirmed. Only the headline was available, so the full article could not be reviewed.

Am I affected?

Not confirmed. The source names no affected systems, data types or individuals.

What to do now

  1. If you have a relationship with ehrenwall.de, watch for an official statement from the organisation.
  2. Do not download or share any data said to be linked to the leak-site listing.
  3. Check back for updates. This advisory will change if a primary source confirms or rejects the claim.

Sources