peus-muenzen.de Listed by safepay Ransomware Group

On December 19, 2025, the German coin dealer Peus Münzen appeared on the leak site of the safepay ransomware group. The company, formally known as Dr. Busso Peus Nachfolger e.K., is one of Germany’s oldest and most respected numismatic auction houses. Public reporting indicates that internal files were exfiltrated during a ransomware attack. While the exact number of people whose information was taken remains unknown, anyone who has bought, sold, or consigned coins through the firm in recent years may have records included in the stolen data.

What's Publicly Reported from Reporting

Available reporting describes the incident as a classic ransomware operation. The attackers gained access to Peus Münzen’s systems, encrypted data, and then exfiltrated files before demanding payment. The December 19, 2025 listing on the safepay leak site states that at least some internal documents were published after the company apparently declined to meet the ransom demand. Data types mentioned in the posting include internal files; specific categories such as customer names, addresses, payment details, or consignment records have not been independently verified by third parties. No public timeline has been released detailing exactly when the initial breach occurred.

Why This Matters for You and Your Family

When a specialized business like a coin dealer is breached, the information exposed often includes names, physical addresses, phone numbers, email addresses, and transaction histories. If you or anyone in your household has ever purchased rare coins, participated in an auction, or consigned items to Peus Münzen, those details may now be in the hands of criminals. Personal data from such purchases can be combined with other leaks to build a complete profile of your finances and location. For families, this risk extends beyond the primary account holder: shared addresses, children’s names listed on shipping records, or family email accounts used for correspondence can all become targets.

Once criminals possess even partial customer records, they can attempt identity theft, fraudulent loan applications, or targeted phishing campaigns that appear legitimate because they reference your past purchases.

The Doxxing and Identity-Chain Implications

Stolen customer files rarely stay isolated. Attackers frequently cross-reference names and addresses against other breach databases, social-media handles, and gaming accounts. A single coin-auction receipt that lists both a parent’s email and a child’s name can link an adult identity to a teenager’s Fortnite or Roblox username. From there, credential-stuffing attacks can seize those gaming accounts, which often contain linked payment methods and chat histories that reveal even more personal information. This creates an identity chain that turns one breach into repeated harassment, doxxing, or financial fraud affecting every member of the household.

Credential leaks like this one frequently cascade into account takeovers precisely because people reuse passwords across shopping sites, email, and gaming services.

Safepay Group’s Publicly Known Track Record

Public reporting attributes the attack to the safepay ransomware group. The group emerged in 2024 and has since targeted organizations across Europe and North America. Notable prior victims include mid-sized manufacturing firms, professional service providers, and retailers whose customer databases were later posted on the same leak site. Their typical playbook begins with phishing or exploitation of remote-desktop services for initial access, followed by exfiltration of internal files and deployment of ransomware. If payment is not received within their stated deadline, they publish samples of the stolen data and threaten full release or sale on underground forums. The group’s extortion style combines public shaming on their leak site with direct contact to affected customers when contact information is available.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Peus Münzen or similar auction sites and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your family is caught in hours, not months.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing your own accounts.

The incident shows that even long-established specialist businesses can become entry points for identity theft that reaches your family. Taking deliberate steps now limits how far criminals can travel down the identity chain created by this and future breaches. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including protection for your children’s gaming accounts that are frequently swept up in these cascades.