The decor-metall.de ransomware claim attributes the attack to the threat actor safepay, targeting a well-established German company specializing in point-of-sale solutions. The attack has impacted Germany.
Incident Details
- Victim: decor-metall.de
- Country: DE
- Actor: safepay
- Source: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/decor-metallde/
- Discovered: 2025-08-28 19:33:22.162904
- Published: 2025-08-28 19:33:09.689117
Information
- The company decor metall GmbH has been established since 1963 and is based in Bad Salzuflen, Germany.
- It specializes in point-of-sale (POS) solutions.
- It is recognized globally within its industry.
- The ransomware was deployed by the actor safepay.

Disclaimer: This post is based on public claims made by the ransomware group "safepay". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.