RTN GmbH Data Breach

RTN GmbH, a business services organization based in Germany, has been identified as a potential victim of the SafePay ransomware group. The listing appeared on the SafePay ransomware group’s dark web portal on July 6, 2026, and was detected by SOCRadar’s Dark Web Monitoring service. The company operates within the business services sector, and the incident aligns with SafePay’s recent targeting patterns.

SOCRadar’s analysis of infostealer-log telemetry returned no direct records for RTN GmbH’s domain (rtngmbh.de) in the queried data. However, this absence does not confirm the organization’s security or rule out a potential breach. Credentials obtained through stealer logs are a documented initial access vector for ransomware groups like SafePay, who source and utilize these credentials for corporate network access. The lack of direct evidence in this query may be due to data sampling limitations, credentials being used and rotated before indexing, or access through alternative means such as personal email aliases. CTI teams are advised to maintain continuous monitoring and implement proactive credential hygiene measures.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.