Ransomware Group: SAFEPAY

VICTIM NAME: niemann[.]de

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page reports an attack against Niemann.de, a German company specializing in the manufacturing of high-quality surfaces and materials for interior design and furniture. The attack was discovered on April 16, 2025, and involves a claimed compromise date of the same day. Despite the attack, there is no publicly available information indicating the number of employees affected or specific data exfiltrated. The breach appears to be linked to a group identified as “safepay,” and the attackers have provided a claim URL hosted on the dark web for proof or further communication.

Niemann.de operates in Germany, with a focus on interior and furniture design solutions, offering products such as high gloss and matte finishes. The leak page indicates potential data exposure but does not include detailed information about the extent or nature of the compromised data. The absence of visible screenshots suggests no visual evidence of the breach or internal documents is publicly available at this time. The leak, if verified, highlights the ongoing cybersecurity risks faced by companies in the manufacturing and design sectors, emphasizing the importance of robust data security measures.