akd-ekbo.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a ransomware group lists an organisation on its leak site, the people connected to that organisation face immediate practical questions: whether their contact details, employment records or other personal information have left the organisation’s systems, and what that could mean for their privacy and daily security. On 19 June 2025 the domain akd-ekbo.de appeared on a listing attributed to the safepay ransomware group, which claims that internal files were taken in a ransomware attack. The number of people affected remains unknown, and public detail about the precise contents is limited, yet the listing alone is enough to warrant careful attention from staff, volunteers and anyone whose data may have been held by the Amt für kirchliche Dienste.

This article sets out only what has been reported, places the claim in the context of how safepay operates, and explains the concrete steps individuals can take while further information is awaited.

Inside the incident

According to the available record, akd-ekbo.de was listed by the safepay ransomware group on 19 June 2025. The group’s claim is that internal files were exfiltrated during a ransomware attack. No figure has been published for the number of people whose data may be involved, and the report does not disclose the date the intrusion began, the technical method used, the volume of data taken, or whether encryption of systems also occurred. Public detail is therefore limited to the fact of the listing and the assertion that internal files left the organisation’s control. Until the organisation or independent investigators release further verified information, the scale and full timeline remain unconfirmed.

Who is safepay?

Safepay is a ransomware operation that has been observed conducting double-extortion attacks: after gaining access to a network it encrypts systems and simultaneously copies data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Like other groups of this type, it typically advertises victims by name and domain, sometimes accompanied by sample files, in an effort to increase pressure. The listing of akd-ekbo.de is therefore a claim made by the group itself; it has not been independently confirmed in the public record supplied for this incident. Safepay’s earlier activity has targeted organisations across several sectors, but no additional statements by the group specifically about this victim beyond the listing itself are part of the known facts.

akd-ekbo.de and its sector

The Amt für kirchliche Dienste (AKD) is the central continuing-education institution serving professional and volunteer staff of the Evangelical Church in Berlin-Brandenburg-schlesische Oberlausitz (EKBO). Its website, akd-ekbo.de, supports training programmes, administrative coordination and communication for church employees and volunteers. Organisations of this kind routinely process personnel records, course enrolments, contact details, and internal correspondence related to pastoral and educational work. A breach affecting such an institution is consequential because the data often combine professional and personal elements, and because the people involved—clergy, educators, administrators and volunteers—may not expect their information to appear in criminal leak channels. The religious and educational character of the work also means that trust and confidentiality are central to the organisation’s mission, so any unauthorised disclosure carries reputational as well as practical weight.

What data was at risk

The only data category named in the public report is “internal files” said to have been exfiltrated. No further breakdown—such as whether the files contained names, addresses, bank details, training records or correspondence—has been disclosed. Organisations that provide continuing education for church staff typically hold personnel files, participant lists, email archives and administrative documents; those categories are therefore the sorts of material that could be present. Exact contents, however, remain unconfirmed, and it would be inaccurate to treat any specific type of personal data as verified fact on the basis of the current record.

What's at stake

For individuals, the principal risks are the ordinary consequences of internal files circulating outside authorised control: possible exposure of contact information that could be used for phishing or social-engineering attempts, and the longer-term possibility that personal or professional details become available to third parties. Because the number of people affected is unknown, it is not yet possible to gauge how widely these risks extend. For the organisation itself, the stakes include the need to investigate the intrusion, notify any affected parties under applicable data-protection rules, restore secure operations, and maintain the confidence of the staff and volunteers it serves. None of these outcomes is automatic; they depend on the still-undisclosed details of what was taken and how the incident is handled.

If your data was in this claimed breach

If you have a connection to the Amt für kirchliche Dienste—as staff, volunteer, course participant or correspondent—treat the listing as a prompt for basic hygiene rather than as proof that your own records were taken. Monitor financial and email accounts for unexpected activity, enable multi-factor authentication wherever it is offered, and be sceptical of unsolicited messages that reference church training or personal details. You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Should the organisation issue official notifications or guidance, follow those instructions promptly; until then, the practical steps above remain the most reliable first response.

AICompiled with AI assistance from public sources and published under our editorial standards.