pau.at Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 21, 2025, the ransomware group safepay listed the Austrian architectural practice pau.at on its leak site. The listing states that internal files were exfiltrated during a ransomware attack, though the number of people affected and the precise contents of any data remain undisclosed. The incident raises straightforward questions for clients, partners and staff whose records may have been held by the firm. Architectural practices routinely store project documentation, correspondence and administrative records that can contain personal or commercial details.

Breaking down the breach

The only confirmed information is the December 21, 2025 listing by safepay. No public statement from pau.at has detailed the date of the intrusion, the method of access, the volume of data taken or whether any files were subsequently published. The group’s listing refers to exfiltrated internal files, but provides no further breakdown. The number of individuals potentially affected is recorded as unknown.

Who is safepay?

Safepay is a ransomware operation that has appeared on leak sites since at least 2024. Like other groups in this category, it typically claims to have encrypted systems and copied data from targeted organisations, then uses a leak site to pressure victims into payment by threatening to release the material. The listing of pau.at constitutes the group’s claim; independent confirmation of the data’s authenticity or scope has not been reported.

pau.at and its sector

PAUAT Architekten, operating as pau.at, is a regional architectural practice based in Wels, Austria. It was founded in 1999 and is led by architect Heinz Plöderl. Firms of this type manage design projects for buildings and infrastructure, which involves correspondence with clients, contractors and public authorities as well as technical drawings and administrative records. A breach at such an organisation can therefore touch both personal data of individuals and commercially sensitive project information.

The information in question

The listing refers only to “internal files.” No inventory of specific data categories has been released. Organisations in the architectural sector commonly hold client contact details, contract documents, site plans and financial records, but the exact contents of any exfiltrated material from pau.at are unconfirmed.

What's at stake

Where personal or project-related files are involved, affected individuals may face risks of identity misuse or unwanted disclosure of private correspondence. For the practice itself, the exposure of design documents or client communications can affect ongoing projects and commercial relationships. Because the scale and nature of the data remain unknown, the practical consequences cannot yet be quantified.

What to do if you're exposed

Individuals who have worked with pau.at or similar practices should monitor their email and financial accounts for unusual activity and consider enabling multi-factor authentication on important services. A free exposure scan using a known email address can indicate whether that address has appeared in previously published breach data sets. Organisations in the same sector are advised to review access controls and incident-response plans as a standard precaution.

AICompiled with AI assistance from public sources and published under our editorial standards.