notar-gerresheim.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 17, 2025, the ransomware group safepay listed notar-gerresheim.de on its site and stated that internal files had been taken from the organization. The listing provides no confirmed count of affected individuals, no description of specific file contents, and no indication of whether data was later published or sold. For people whose records are held by a notary office, the incident raises the possibility that personal identifiers, legal documents, or financial details could be exposed without any public confirmation of the scope. The practical stakes center on the nature of the records involved. Notary offices routinely process documents that establish identity, property ownership, and contractual obligations, so any confirmed exfiltration would affect individuals and businesses whose affairs were handled by the firm.

Breaking down the breach

The only confirmed detail is the December 17, 2025 listing by safepay. The group claims internal files were exfiltrated during a ransomware attack, but no timeline for the intrusion, no volume of data, and no method of initial access have been disclosed. The number of people affected is listed as unknown, and there is no public statement from the organization confirming or denying the claims.

Inside safepay

Safepay is a ransomware operation that maintains a leak site to list organizations it claims to have compromised. The group typically encrypts systems and exfiltrates data, then uses the site to pressure victims by threatening to release the material. Its listings are presented as claims by the group; independent verification of each entry is not provided by the site itself.

notar-gerresheim.de and its sector

Notare Dr. Heinrich & Dr. Berg operates as a private notary office in the Gerresheim district of Düsseldorf, Germany. Notary offices in Germany authenticate legal acts such as property transfers, company formations, wills, and powers of attorney. They are required to maintain detailed records of these transactions and the parties involved.

What data was at risk

The listing states only that internal files were exfiltrated. The exact categories of data have not been disclosed. Organizations of this type commonly hold identification documents, addresses, financial details related to transactions, and records of legal agreements, but the precise contents of any exfiltrated material remain unconfirmed.

Why it matters

Legal and identity documents held by notaries can be difficult to replace and carry long-term consequences if misused. Individuals named in the records may face risks of identity misuse or complications in ongoing legal matters, while the organization must address potential regulatory obligations under German data-protection rules. No confirmed evidence of subsequent misuse has been reported.

Were you affected?

Begin by contacting Notare Dr. Heinrich & Dr. Berg directly for any official notification. Monitor bank and official correspondence for unusual activity. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.