Skip to content
ehrenwall.de
Germany1 source
Claimed:Safepay claimed it on a ransomware leak site on 4 Nov 2026. Not confirmed by the organisation, so treat it as a claim, not a fact.
Safepay claims ehrenwall.de
The Safepay group listed ehrenwall.de on its leak site. The organisation has not confirmed an attack, so treat this as a claim.
- Type
- Ransomware
- Claimed by
- Safepay
- First reported
- 4 Nov 2026
- Latest source
- 4 Nov 2026
What to do
- This is only a claim by the attackers so far. Do not panic, but do the basics:
- Expect delays if you rely on this organisation's services, and keep records of anything you are owed.
- If you have an account, change that password, and anywhere you reused it.
- Treat this as unverified. Ask the organisation directly before acting on it.
- If you connect to this organisation (VPN, file transfer, email), review and restrict those links until they confirm containment.
- Check that your own backups are offline or immutable and that you have tested a restore recently.
Not sure? Ask an assistant with the sources attached, or have a coding agent check your systems.
Check your systems for ehrenwall.de
Safepay has also hit
- prospecthillcamberwell.com.au4 NovClaimed:Safepay claims prospecthillcamberwell.com.auAU
- jhz-bernardshof.de4 NovClaimed:Safepay claims jhz-bernardshof.deDE
- sportschule-steinbach.de4 NovClaimed:Safepay claims sportschule-steinbach.deDE
- fuss-sprunggelenk.de4 NovClaimed:Safepay claims fuss-sprunggelenk.deDE
- Universidad Autónoma de Aguascalientes1 NovClaimed:SafePay ransomware targets Mexican universityMX
- layam.com31 OctClaimed:Safepay claims to have breached Israeli duty-free retailer layam.comIL
Sources
1Confidence 23% that this is real and correctly placed. Locations are city centroids at best. Spotted an error? Report a correction.