LBB Treuhand Data Breach

LBB Treuhand, a business services company headquartered in Germany, has been identified as a victim on the dark web portal of the SafePay ransomware group. The listing, published on July 20, 2026, was detected by SOCRadar’s Dark Web Monitoring service. The organization operates within the business services sector, which has been a frequently targeted industry by SafePay in recent operations. This listing is part of a significant batch of German entities that SafePay has recently added to its leak site. In the 60 days preceding this listing, SafePay has claimed approximately 36 other victims. The ransomware group’s activities show a clear preference for targeting organizations in the business services, manufacturing, and technology sectors. Geographically, Germany represents the primary focus for SafePay’s attacks, with smaller numbers of victims also noted in Japan, Canada, and the United States. LBB Treuhand’s profile aligns closely with SafePay’s recent pattern of targeting German companies within the business services industry, with other related victims including Mende Grundbesitz, A.C. Small & Maxwell, TimeTEX, and Cenesco.

SOCRadar’s analysis of stealer-log telemetry related to initial access yielded no direct records for the domain lbb-treuhand.de within the queried data slice. It is crucial to understand that a null result from this specific query does not definitively confirm that the organization is unaffected by any compromise. The telemetry data represents a partial, paginated sample from a single data source. It is possible that credentials associated with LBB Treuhand exist under alternative corporate domains, may reside in data feeds not included in this analysis, or could be linked to personal email aliases that do not map directly to the corporate domain. Therefore, this finding should be interpreted as “no evidence found in this specific slice of data,” rather than an absolute confirmation of no compromise. For ransomware operations like those conducted by SafePay, credentials harvested by infostealers are a recognized vector for initial access. Threat actors or initial access brokers often acquire recent credential logs from underground marketplaces. These credentials are then validated and used to gain access to corporate systems such as Microsoft 365, VPNs, or remote-access portals, paving the way for ransomware deployment. The absence of direct correlation in this query does not preclude such a scenario. It is possible that relevant credentials surfaced in data feeds outside the scope of this analysis, were utilized and rotated by the threat actor before being indexed, or were harvested using personal email addresses. Consequently, CTI teams should continue monitoring and conduct proactive credential hygiene checks rather than relying on a null query as definitive proof of security.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.