peus-muenzen.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 19, 2025, the ransomware group safepay listed peus-muenzen.de on its site, stating that internal files had been exfiltrated from the organization. The victim is identified as Dr. Busso Peus Nachfolger e.K., a long-established German coin dealership. No figure for the number of individuals affected has been released, and no confirmation of the listing’s accuracy or the scope of any data release has been made public. This incident occurs against a backdrop of sustained ransomware activity in which groups publish claims of stolen data to pressure organizations. Such listings are now a routine element of extortion campaigns, even when the underlying access or data volume remains unverified by independent sources.

Breaking down the breach

The only confirmed public detail is the December 19, 2025 listing by safepay. The group asserts that internal files were taken during a ransomware operation. No information has been released on the date of the intrusion, the method of initial access, the volume of data involved, or whether encryption was also deployed. The number of people whose information may be affected is stated as unknown.

The group behind it: safepay

Safepay is a ransomware operation that follows the double-extortion model common among current threat actors. After gaining access to a target network, the group typically exfiltrates data and then lists the victim on a dedicated leak site if ransom demands are not met. The listing itself constitutes the group’s claim of possession; independent verification of the data or the intrusion is not provided by the actor. Safepay has appeared in public reporting on multiple incidents across different sectors, though specifics tied to this victim remain limited to the single published claim.

peus-muenzen.de and its sector

Peus Münzen, operating as Dr. Busso Peus Nachfolger e.K., is among Germany’s oldest coin dealerships and focuses on numismatic sales and related services. Organizations in this sector routinely maintain records of customer transactions, authentication details, shipping addresses, and payment information. A breach at such an entity is consequential because the data held can include long-term client relationships and financial records that retain value over extended periods.

What data was at risk

The listing refers only to “internal files” without further specification. The precise categories of information involved have not been disclosed. In the absence of Reported Details, the contents remain unverified.

The real-world impact

Exfiltrated internal files from a specialist dealer can contain customer identifiers, transaction histories, and operational records. If personal or financial data are present, affected individuals may face risks of account misuse or targeted fraud. For the organization, the incident adds pressure around incident response, regulatory notification requirements under German and European data-protection rules, and potential reputational effects within a niche collector community. No confirmed instances of subsequent misuse have been reported in connection with this listing.

Were you affected?

Individuals who have conducted business with peus-muenzen.de should monitor their financial accounts and email for unusual activity. Organizations of this type commonly hold contact details and transaction data, so vigilance regarding statements and correspondence is warranted. The exact scope of exposure remains unconfirmed.

• Review recent account statements for unrecognized transactions.
• Enable or verify multi-factor authentication on any linked services.
• Run a free exposure scan of your email address against known breach datasets.
• Consider placing fraud alerts with credit agencies if personal identifiers were likely involved.

AICompiled with AI assistance from public sources and published under our editorial standards.