notar-gerresheim.de Listed by safepay Ransomware Group

On December 17, 2025, the German notary office Notare Dr. Heinrich & Dr. Berg in Düsseldorf’s Gerresheim district appeared on the leak site of the safepay ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, and the firm’s data is now publicly listed, putting the personal and financial details of clients, employees, and the notaries themselves at risk of further exposure.

What's Publicly Reported from Reporting

Public reporting indicates that safepay posted the notary office on its dark-web leak site on December 17, 2025. The compromised entity is a private notary practice located in the Gerresheim district of Düsseldorf, Germany. Available reporting describes the stolen material as internal files exfiltrated during a ransomware incident. The exact number of individuals affected remains unknown, as does the precise volume and sensitivity of the documents. No evidence has surfaced that the attackers have yet published the full dataset, but its presence on the leak site signals that the data is available to other criminals.

Why This Matters for You and Your Family

When a local notary’s systems are breached, the documents often contain names, addresses, dates of birth, bank details, tax records, property deeds, and inheritance information. These records frequently include data belonging to ordinary families who used the notary for house purchases, wills, or business agreements. Once such information leaves a secure environment, it can be sold, combined with other leaks, or used to impersonate you. For your family this means heightened risk of identity theft, fraudulent loan applications in your name, or targeted scams that reference real details only a notary would possess. The breach is a reminder that even small, trusted professional offices hold information that directly affects your financial security and privacy.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. Criminals routinely cross-reference newly exposed notary files against other breaches to build detailed identity chains. A phone number listed in a property deed can be linked to an email from an earlier breach, which in turn reveals social-media handles or children’s gaming accounts. These chains allow attackers to move from simple data sales to full doxxing, extortion, or account takeovers. Credential leaks like this one often cascade into gaming platforms, where a child’s reused password can lead to further personal details being harvested. The longer the chain grows, the harder it becomes for an ordinary person to untangle and protect every linked account.

Safepay Group’s Known Track Record

Public reporting attributes the attack to the safepay ransomware group. The group emerged in recent years and has targeted organizations across Europe and North America. Notable prior victims include healthcare providers, legal practices, and small-to-medium businesses whose internal documents were later posted on dedicated leak sites. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. They then demand payment and, if unmet, publish samples or full datasets on their onion-site blog to pressure victims. Reporting notes that safepay often sets short deadlines for payment before escalating public exposure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Rotate any password you ever used at the notary office or similar professional services, and switch on two-factor authentication through an authenticator app everywhere that password was reused.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which frequently chain back to the same addresses and identities exposed in professional breaches.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing day-to-day accounts.

The incident shows that data held by everyday service providers can quickly become public fuel for larger identity crimes. Taking deliberate steps now limits how far any single breach can reach. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to map and reduce your family’s exposure before the next leak appears.