dfcsystems.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In recent years ransomware groups have continued to focus on organisations whose systems support essential services, including healthcare-related software providers. On 19 December 2025 the domain dfcsystems.de was listed by the Safepay ransomware group, which stated that internal files had been taken during an attack on the company. The scale of the incident, including the volume of data removed and the number of people potentially affected, has not been made public.

Inside the incident

The listing appeared on 19 December 2025. According to the available information, the group claims to have exfiltrated internal files in the course of a ransomware operation against DFC-SYSTEMS GmbH. No further technical details, such as the initial access method or the duration of unauthorised access, have been released. The number of individuals whose information may be involved is also unknown.

Inside safepay

Safepay is a ransomware operation that follows the double-extortion model commonly observed in recent years. The group typically encrypts systems and removes copies of data before demanding payment. It maintains a leak site where it lists organisations it claims to have compromised, often releasing samples or descriptions of the material it says it holds. Public reporting on the group has documented similar activity against entities in multiple countries, though each listing remains an unverified claim until independently confirmed.

Who is dfcsystems.de?

DFC-SYSTEMS GmbH is a German software and technology company based in Munich. Its work centres on clinical documentation and digital workflow solutions. Organisations in this sector routinely process records that support medical and administrative processes within healthcare settings. A compromise at such a provider can therefore intersect with data that is both operationally sensitive and subject to regulatory protections.

The information in question

The only detail released so far is that internal files were allegedly exfiltrated. The precise categories of information contained in those files have not been disclosed. Companies of this type commonly hold configuration data, project documentation, customer correspondence and system logs; however, the exact contents involved in this case remain unconfirmed.

Why it matters

Files taken from a clinical software provider can include material that affects both the company’s clients and the individuals whose records are managed through its systems. Even without confirmed personal data, the exposure of internal operational files can create secondary risks such as targeted follow-on attacks or the misuse of proprietary processes. For the organisation itself, the incident adds to the costs and operational disruption already associated with ransomware recovery.

If your data was in this claimed breach

Individuals who have interacted with DFC-SYSTEMS GmbH or its client organisations can take several practical steps while further details remain limited.

• Monitor official statements from the company for any confirmed information about the scope of the incident.
• Review account activity for any services that rely on the affected systems.
• Run a free exposure scan of your email address against known breach data to check for prior appearances of your information.
• Where possible, enable or strengthen multi-factor authentication on accounts linked to healthcare or administrative services.

AICompiled with AI assistance from public sources and published under our editorial standards.