ferienwohnungen.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target online service platforms that hold customer and operational data, using public leak sites to pressure victims after claiming to have stolen files. In this environment, listings appear regularly and often leave affected people with limited confirmed detail about what was taken or how widely it may circulate.

On August 26, 2025, the German holiday-booking platform ferienwohnungen.de was listed by the safepay ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and the precise contents of the files have not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope has not been made public.

Breaking down the breach

According to available reporting, ferienwohnungen.de appeared on a safepay leak-site listing dated August 26, 2025. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data, the number of systems involved, or the exact date the intrusion began. The method of initial access, any encryption of systems, and whether a ransom was demanded or paid are all undisclosed. People affected are listed as unknown. Beyond the group’s claim that internal files were taken, further technical detail has not been released in the public record used for this account.

Who is safepay?

Safepay is a ransomware operation that has been observed conducting double-extortion campaigns: operators claim to steal data before encrypting systems and then threaten to publish the material if payment is not made. Like other groups in this category, safepay maintains a leak site where it posts victim names and, in some cases, sample files to increase pressure. Public tracking of the group has noted activity against organisations in multiple sectors, with listings typically framed as proof of successful intrusion and data theft. In the present case the group claims ferienwohnungen.de as a victim and asserts that internal files were exfiltrated; those assertions remain claims unless corroborated by the organisation or independent investigators. No additional statements attributed specifically to safepay about this victim beyond the listing itself are part of the reported facts.

ferienwohnungen.de and its sector

Ferienwohnungen.de is a German online booking platform that connects travellers with more than 77,000 holiday homes and apartments across Europe. Platforms of this type sit between property owners or managers and guests, handling search, reservation, and often payment-related workflows. They typically store account details, booking histories, contact information, and operational records needed to manage listings and customer support. Because the service deals with travel and temporary accommodation, it may also hold passport or identity data required for check-in in some jurisdictions, though that is not confirmed here. A breach affecting such a platform is consequential because it can expose both travellers and property providers, disrupt booking operations, and create lasting trust issues for a service that relies on personal and financial information to function.

The information in question

The reported facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as customer databases, employee records, financial documents, or source code—has been disclosed. Organisations operating holiday-booking platforms commonly hold names, email addresses, phone numbers, booking dates, property addresses, and payment or invoice data. They may also retain internal correspondence, contracts with hosts, and system configuration files. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the files claimed by safepay. Readers should treat any specific claims about particular data elements as unverified until the organisation or competent authorities provide additional detail.

What's at stake

For individuals, the primary risks are identity misuse, targeted phishing, and fraudulent booking or payment attempts that exploit knowledge of past travel or contact details. Even limited internal files can contain enough personal information to craft convincing messages. For property owners and managers who list on the platform, exposure of contracts or financial records could lead to social-engineering attacks or competitive harm. The organisation itself faces operational disruption, potential regulatory scrutiny under European data-protection rules, and reputational damage that can reduce bookings. Because the number of people affected is unknown and the data types are not fully described, the scale of these risks cannot yet be quantified; the absence of confirmed numbers does not eliminate the possibility of real-world harm.

What to do if you're exposed

If you have used ferienwohnungen.de, monitor account activity and change passwords on the platform and any related email accounts, preferably enabling multi-factor authentication where available. Watch bank and card statements for unexpected charges and treat unsolicited messages that reference past bookings with caution. Consider placing a fraud alert with credit-monitoring services if you believe financial data may have been involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check does not confirm involvement in this specific incident but can indicate whether credentials or personal details are circulating more widely. Stay alert for official statements from the platform or data-protection authorities for any further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.