hahn-airport.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
A ransomware group called safepay has listed hahn-airport.de as breached, with internal files taken in the attack dated July 03, 2026. If you have any connection to the airport, check for notices from them and review your accounts and data for signs of exposure.
On July 6, 2026, the domain hahn-airport.de appeared on a listing associated with the safepay ransomware group. The entry states that internal files were exfiltrated during a ransomware attack. No figure for the number of people affected has been released, and the airport has not issued a public statement confirming or denying the claims.
The incident matters because hahn-airport.de operates a civilian airport that processes passenger movements, staff records, and operational documents. Any confirmed exposure of such material would fall under standard data-protection obligations for transport operators.
Inside the incident
The only confirmed public detail is the July 6, 2026 listing. The group claims internal files were taken; no volume, file categories, or exfiltration dates have been published by either the group or the airport. It remains undisclosed whether encryption occurred, whether ransom demands were issued, or whether any data has been published beyond the initial listing.
Inside safepay
Safepay is a ransomware operation that maintains a leak site to list organisations it claims to have targeted. The group typically states that data was copied before encryption and uses the site to pressure victims. Its listing of hahn-airport.de constitutes an unverified claim by the group; independent confirmation of the data theft has not been reported.
Who is hahn-airport.de?
Hahn-airport.de is the operator of Frankfurt-Hahn Airport in Germany. The site was originally constructed as a United States military air base and transitioned to civilian use in 1993. Airports of this type routinely hold passenger booking data, identity documents, flight manifests, and internal administrative records.
What data was at risk
The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of data categories has been supplied. The precise contents therefore remain unconfirmed.
What's at stake
Individuals named in airport records could face risks of identity misuse or targeted fraud if personal details were among the files. The airport itself may incur regulatory scrutiny and operational costs while assessing the scope of any confirmed exposure.
What to do if you're exposed
Anyone who has flown through or worked at the airport should treat the situation as a standard precaution until more information is released.
- Review recent bank and credit-card statements for unfamiliar activity.
- Enable or strengthen multi-factor authentication on any accounts linked to the airport.
- Run a free exposure scan of your email address against known breach datasets.
- Retain records of any correspondence from the airport should official notifications be issued later.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Berlinmobil.de Listed by safepay Ransomware Groupcaritas-koblenz.de Listed by safepay Ransomware Groupshw-fr.de Listed by safepay Ransomware Grouplh-wohnverbund-wohnen-nrw.de Listed by safepay Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the hahn-airport.de Listed by safepay Ransomware Group →
Publicly posted by safepay — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.