On December 5, 2025, the German online retailer wachtmann.eu appeared on the leak site of the safepay ransomware group. The attackers claim to have stolen internal files from the small e-commerce business, which sells consumer goods through its web store. While the exact number of customers affected remains unknown, anyone who has shopped there, created an account, or provided contact details could have personal information now in criminal hands.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch wachtmann.eu
Get alerted the next time wachtmann.eu files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about wachtmann.eu’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the incident is a classic ransomware attack followed by data exfiltration. The safepay group posted details on its dark-web leak site, listing wachtmann.eu as a victim. Available reporting describes the company as a typical small online retailer sourcing and selling everyday consumer products. No confirmed total of records exposed has been published, but the data includes internal files that almost certainly contain customer orders, contact information, and possibly payment details. The posting date of December 5, 2025 marks the moment the information became publicly available to other criminals.
Why This Matters for You and Your Family
When a retailer you have used suffers a breach, your name, delivery address, email, and phone number can quickly spread across underground forums. Criminals buy this data in bulk and combine it with other leaks to build profiles. For families this often means every adult and sometimes children become targets for phishing, identity theft, or harassment. Even if you only placed one order years ago, the information rarely disappears on its own. Internal files from an e-commerce site frequently hold more than marketers admit, turning a single shopping trip into long-term exposure for you and anyone sharing your household address.
The Doxxing and Identity-Chain Implications
Stolen customer records rarely stay isolated. Attackers link an email address from one breach to usernames on social media, gaming platforms, and other shopping sites. This creates an identity chain that can lead to doxxing, account takeovers, and targeted scams. Credential leaks like this one cascade into gaming accounts belonging to you or your children, where the same reused password or linked email grants entry. Once inside a family member’s Discord, Roblox, or Steam profile, attackers can harass, extort, or further expand the chain. The speed at which these connections form is why early visibility matters.