THREAT WATCH · September 30, 2026 · RANSOMWARE LISTING

German Services Firm Listed on SAFEPAY Ransomware Tracker

A German services organization operating under the domain wolfusofsky.de has been recorded on a ransomware tracker associated with the SAFEPAY group. The listing was dated September 30, 2026. The company falls into the 51 to 100 employee size range. No data has been publicly disclosed as of this writing. This entry is a signal that the organization may have been targeted by ransomware actors. It is not confirmation of a completed breach. Intel128 records such listings as early indicators and tracks them over time to assess whether claims are substantiated.

Key takeaways

• wolfusofsky.de was recorded on a SAFEPAY ransomware tracker on September 30, 2026
• No data has been publicly disclosed as of this writing
• The listing is an unverified claim, not a confirmed breach
• Security teams should review supply chain exposure to this domain

What the listing tells us

• The organization wolfusofsky.de appears on a tracker maintained by the SAFEPAY ransomware group.
• The listing date is September 30, 2026.
• The company is based in Germany and operates in the services sector.
• It is classified as a mid-sized firm with between 51 and 100 employees.
• No stolen data has been published on the tracker at this time.
• The disclosure status remains "not disclosed yet," which means the group has listed the domain but has not released any files or records.

What SAFEPAY is

SAFEPAY is a ransomware group that operates a leak site where it posts the names and domains of organizations it claims to have compromised. Groups like SAFEPAY typically use these listings as a pressure tactic to push victims toward paying a ransom. The presence of a domain on such a tracker does not prove that data was exfiltrated or that systems were encrypted. It indicates that the group is asserting a claim of compromise. In some cases, groups list domains they have not actually breached, either as a bluff or as part of a broader extortion campaign. Intel128 treats all such listings as unverified claims until corroborated by additional evidence.

Why this matters for the organization

• A listing on a ransomware tracker can damage reputation even before any data is released.
• Customers and partners may ask questions about the company's security posture.
• If data is later disclosed, the organization faces regulatory scrutiny under German and EU data protection rules.
• The company may face direct pressure from the group to negotiate or pay.
• Mid-sized service providers are frequent targets because they often hold data on behalf of larger clients.

What to watch next

• Whether SAFEPAY publishes any data related to this domain in the coming days or weeks.
• Whether the organization issues a public statement or confirms an incident.
• Whether German data protection authorities open an inquiry.
• Whether the listing is removed, which sometimes happens when a group cannot substantiate its claim.
• Whether additional domains from the same organization appear on the tracker.

Recommended actions for security teams

• Check whether your own supply chain includes this organization or its domain.
• Review any recent vendor risk assessments that cover German services providers of this size.
• Monitor for data disclosure events tied to this domain over the next 30 days.
• If you share data with this company, confirm your incident response agreements are current.
• Consider whether your own exposure to this vendor requires a formal risk review.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.