bannenbergandrowell.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised professional services firms, using data theft and public leak-site postings as leverage even when the precise scale of an incident remains unclear. In this environment, a listing by a known actor can signal that internal material has been taken and may be released, regardless of whether the organisation has confirmed the event.

On 24 October 2025, the domain bannenbergandrowell.com was listed by the safepay ransomware group. Public reporting indicates that internal files were claimed to have been exfiltrated in a ransomware attack. The number of people affected is unknown, and further technical detail has not been disclosed. For clients, partners and staff of a high-end design studio, the listing raises practical questions about what may have left the organisation’s systems and what steps to take next.

Breaking down the breach

According to available reporting, bannenbergandrowell.com appeared on a safepay leak site on 24 October 2025. The group’s claim centres on the exfiltration of internal files as part of a ransomware attack. No public confirmation of the intrusion method, the volume of data taken, or any ransom demand has been released. The number of individuals potentially affected remains unknown. Because the listing itself is an unverified assertion by the threat actor, the precise timeline and scope of any compromise stay unconfirmed beyond the reported claim of internal-file theft.

Who is safepay?

Safepay is a ransomware operation that has appeared in public threat reporting as a group employing double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Like other contemporary ransomware crews, it typically advertises victims on its site to increase pressure. Public documentation of the group describes standard practices such as initial access through common vectors, lateral movement, and data staging before encryption. No additional claims by safepay specifically about this victim—beyond the listing of bannenbergandrowell.com and the assertion of internal-file exfiltration—have been detailed in the available facts. The listing should therefore be treated as the group’s claim rather than independently verified fact.

Who is bannenbergandrowell.com?

Bannenberg & Rowell is a luxury design studio specialising in the exterior and interior design of superyachts. It operates as the direct successor to earlier work in the same field and serves a clientele that includes owners, shipyards and related high-value maritime projects. Organisations of this type routinely handle detailed design drawings, project specifications, client correspondence, contractual documents and commercial information. A breach involving such a firm is consequential because the material often includes commercially sensitive plans and personal or financial details of high-net-worth individuals and their representatives. Even when the exact contents of any stolen archive remain unconfirmed, the sector’s reliance on confidential design and client data makes unauthorised access a material concern for both the studio and those who work with it.

What data was at risk

Public reporting states that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, volumes or specific categories has been disclosed. Organisations engaged in luxury yacht design typically hold architectural and interior plans, client briefs, supplier contracts, financial records and correspondence that may contain personal identifiers or commercial terms. Because the exact contents of the claimed archive have not been confirmed, it is not possible to state which of these categories, if any, were involved. The only named exposure remains the general category of internal files asserted by the threat actor.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, project-related personal data or financial references if those materials later appear online. Clients and partners could face commercial exposure if design concepts or contractual terms become public. For the organisation itself, the consequences can include operational disruption, reputational damage within a relationship-driven luxury market, and the cost of investigation and remediation. Because the number of people affected is unknown and the precise data set is unconfirmed, the impact remains a matter of potential rather than quantified harm at this stage. Monitoring for secondary misuse and preparing for possible public release of material are the immediate practical considerations.

What to do if you're exposed

If you have a relationship with Bannenberg & Rowell—whether as a client, supplier, employee or partner—treat the safepay listing as a prompt for basic hygiene rather than confirmed personal compromise. Concrete first steps include:

• Change passwords on any accounts that may have been used in correspondence with the studio, and enable multi-factor authentication where available.
• Watch financial and email accounts for unexpected activity or phishing that references yacht projects or design work.
• Request confirmation from the organisation about whether your data was involved once official statements become available.
• Preserve any relevant communications in case they are needed for later verification.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets. Remain alert to unsolicited contacts that claim to possess stolen files; such approaches are common after leak-site listings and should be treated with caution.

AICompiled with AI assistance from public sources and published under our editorial standards.