steuerberater-scheerer.de Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
steuerberater-scheerer.de has been listed by the safepay ransomware group after internal files were exfiltrated in a ransomware attack, with the incident reported on December 05, 2025. The number of people affected remains undisclosed, and anyone connected to the firm should verify their exposure and take protective steps.
On December 5, 2025, the ransomware group safepay listed steuerberater-scheerer.de on its data-leak site. The listing states that internal files were exfiltrated from the firm during a ransomware operation. No further details on the number of records, the volume of data, or the timeline of the intrusion have been made public.
Such listings have become a standard element of ransomware campaigns that combine encryption with the threat of disclosure. When the target is a tax-consulting practice, the potential exposure of client financial records raises distinct concerns for individuals and businesses whose data the firm handles.
What happened
The only confirmed information is the December 5, 2025 listing itself. The entry asserts that files were removed from systems belonging to Steuerberater-Scheerer, operating as C. M. Scheerer GmbH. No independent confirmation of the claim, no statement from the firm, and no figures on the scale of the operation have been released.
The group behind it: safepay
Safepay is a ransomware operator that maintains a public leak site to publish data it claims to have stolen. The group typically targets organisations in Europe and North America, using double-extortion tactics that involve both encryption of systems and the subsequent release or sale of exfiltrated material. Its listings are presented as evidence of successful intrusions, though the accuracy of each claim is not independently verified at the time of posting.
About steuerberater-scheerer.de
Steuerberater-Scheerer is a tax-consulting and auditing firm based in Schweinfurt, Bavaria. Practices of this type routinely receive, process and store client tax returns, financial statements, payroll records and correspondence with tax authorities. Because German tax law requires detailed documentation, these firms accumulate large volumes of sensitive personal and corporate information over many years.
What data was at risk
The listing refers only to “internal files.” No inventory of specific record types or client identifiers has been published. Organisations in this sector commonly hold names, addresses, tax identification numbers, bank details, income data and supporting documents. Whether any of these categories were among the exfiltrated material remains unconfirmed.
The real-world impact
Unauthorised access to tax records can enable identity theft, fraudulent filings or targeted financial crime against the individuals and companies concerned. For the firm, the incident may trigger regulatory notification obligations under German data-protection law and could affect client trust. At present, the absence of published details limits any precise assessment of harm.
If your data was in this claimed breach
Monitor bank and tax accounts for unusual activity and consider placing fraud alerts with relevant institutions. Review any correspondence from the firm for guidance it may issue. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their information appears in other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
reger-zahntechnik.de Listed by safepay Ransomware Groupseeberger-appel.de Listed by safepay Ransomware Groupholtzofficesupport.com Listed by safepay Ransomware Groupschoenundendres.de Listed by safepay Ransomware GroupLatest breaches
Publicly posted by safepay — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.