Wirtschaftsverband der deutschen Kautschukindustrie e.V. Data Breach

Wirtschaftsverband der deutschen Kautschukindustrie e.V., an organization based in Germany, has been listed as a victim on the SafePay ransomware group’s dark web portal, with the listing published on July 20, 2026. This discovery was made through SOCRadar’s Dark Web Monitoring service. While the organization’s specific industry is not precisely classified in our data, its name suggests a role as an industry association within the German rubber sector. This listing is part of a significant number of German entities that SafePay surfaced on its portal around this period. In the 60 days preceding this listing, SafePay claimed 36 other victims. The group exhibits a clear targeting pattern, frequently focusing on the business services, manufacturing, and technology sectors. Geographically, the majority of its victims are located in Germany, with smaller numbers in Japan, Canada, and the United States. Recent SafePay victims with a similar German presence include Mende Grundbesitz, Cenesco, Ströbel Gruppe, and TimeTEX. This incident aligns with SafePay’s notable concentration on German entities during this timeframe, fitting within a clear pattern of targeting organizations in Germany.

Initial-access correlation against SOCRadar’s stealer-log telemetry returned no records for wdk.de in the queried slice. It is crucial to understand that a null result does not equate to a confirmation of no compromise. The query reflects a partial, paginated sample from a single data source. Credentials associated with the organization may exist under alternate corporate domains, reside in feeds not included in this dataset, or be linked to personal email aliases that do not map to the corporate domain. Therefore, this finding should be interpreted as “no evidence found in this specific query” rather than absolute exoneration. For ransomware groups like SafePay, credentials harvested by infostealers represent a well-documented initial access vector. Operators or initial access brokers often source recent logs from underground marketplaces, validate corporate credentials, and then use them to access systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. The absence of evidence in this particular query does not preclude this scenario. It is possible that credentials surfaced in data feeds outside of this dataset, were used and rotated before being indexed, or were harvested under personal email aliases. Cybersecurity threat intelligence teams should continue monitoring and conduct proactive credential hygiene checks rather than relying on a null query as definitive proof of a clean system.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.