THREAT WATCH · September 30, 2026 · RANSOMWARE LISTING

SAFEPAY Ransomware Group Lists wolfusofsky.de on Leak Tracker

On September 30, 2026, the ransomware group SAFEPAY recorded the domain wolfusofsky.de on its public leak tracker. The entry lists the domain name as the sole identifier with no additional description. No details such as sector, country, or company size have been recorded by Intel128. No public statement from the organization has been observed. A listing on an attacker-side tracker is a strong signal that data may have been exfiltrated, but it does not confirm a breach.

Key takeaways

• SAFEPAY listed wolfusofsky.de on September 30, 2026
• No public statement from the organization has been recorded
• A listing is a strong signal but not a confirmed breach
• Organizations owning this domain should begin incident response immediately

What was recorded

• The domain wolfusofsky.de appears on the SAFEPAY leak tracker.
• The listing date is September 30, 2026.
• The group's own entry reads only "wolfusofsky.de" with no further description.
• Intel128 has not recorded a country, sector, or company size for this organization.
• No public disclosure or acknowledgment from the organization has been observed.

What a listing means

A ransomware leak tracker is a page maintained by the attacking group. It lists victims whose data the group claims to have stolen. The purpose is pressure: organizations are more likely to pay when they believe their data will be published publicly.

A listing is not proof of a breach. It is a claim made by the attacker. In some cases, groups list organizations that never suffered an intrusion. In other cases, the listing reflects a real compromise where data was taken before encryption was deployed.

For security teams, a listing should be treated as a high-priority signal. It warrants immediate investigation. It does not warrant a public announcement until internal verification is complete. Premature disclosure can complicate response efforts and legal obligations.

What organizations should do

• Check whether your organization owns or operates the domain wolfusofsky.de.
• If it does, initiate incident response procedures immediately.
• Review network logs for the period leading up to September 30, 2026.
• Look for signs of data exfiltration, unusual authentication events, or unauthorized access to file shares and databases.
• Engage your incident response retainer or internal IR team without delay.
• Do not contact the attackers directly without legal counsel present.
• Preserve evidence before making changes to systems or resetting credentials.
• Notify your cyber insurance carrier as soon as possible to preserve coverage.
• Review whether any regulatory notification obligations may apply once scope is understood.

Context on SAFEPAY

Intel128 has recorded SAFEPAY as an active ransomware group. The group maintains a public leak tracker where it publishes victim entries. Intel128 does not have additional verified details about SAFEPAY's operational history, target sectors, or typical ransom demands within this fact block.

Intel128 assessment

The listing of wolfusofsky.de by SAFEPAY is a verified observation from Intel128's tracker crawl. The absence of a public statement from the organization is not unusual in the early hours after a listing appears. Many organizations take time to verify internal impact before responding publicly. Intel128 will update this record if further information becomes available through verified channels.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.