1. Executive summary
The ransomware.live leak index lists t-systems.com as a victim of a group calling itself "safepay", posted 2026-10-05. The listing carries no CVE, no exploitation status and no technical detail; the only substantive data attached to it is a Hudson Rock credential-exposure panel reporting 33 compromised employees, 201 compromised users, 259 third-party employee credentials and an external attack surface of 134 records. There is no MITRE ATT&CK profile for "safepay" in our verified reference data, so the group attribution is unconfirmed and the listing may be a re-brand, a false claim, or a data-theft-only extortion with no encryption. For EMEA financial services clients the exposure is indirect but real: T-Systems is a large managed-services and outsourcing provider, and the same actor has posted four other German-speaking victims in the same window, two of which (lbb-treuhand.de, lfgholding.com) sit in financial and wealth-management services.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk, general principles | The named victim is an ICT service provider; clients that outsource to T-Systems or its subsidiaries hold a contractual third-party dependency that this listing puts in scope. | Clients must confirm whether the affected T-Systems entity is a contracted ICT provider, and if so, obtain the provider's own incident status before treating this as a client-side incident. |
| DORA Art. 29: preliminary assessment of ICT concentration risk | The same actor posted five German-speaking victims in one window, including two financial-services firms; a concentration of exposure across one provider group is the fact Art. 29 asks about. | Where a client's outsourcing is concentrated in the T-Systems group, the concentration assessment should be revisited against this event, not deferred to the next cycle. |
| NIS2 Art. 21(2)(d): supply chain security measures | The listing names a supplier in the client's supply chain, and the credential panel reports 259 third-party employee credentials. | Clients in NIS2 scope should treat third-party credential exposure at a supplier as a supply-chain security event requiring assessment, not only a supplier-side matter. |
No DORA Art. 17/18/19 reporting obligation is engaged on the facts available: nothing in this item establishes that a client's own ICT systems were affected, which is the precondition for the incident-management and reporting articles. If a client confirms its own systems were reached through this provider, that assessment changes.
3. Technical analysis & attack chain
The source material does not support an attack chain. Ransomware.live is a leak-site indexer; it republishes what the operator posted and does not describe initial access, tooling, or encryption. The following is the full extent of what is confirmed.
- An operator using the name "safepay" posted t-systems.com to its leak site on 2026-10-05 at 19:34 UTC.
- The listing records the victim as Germany-based, website t-systems.com.
- The same index entry carries a Hudson Rock credential-exposure panel: 33 compromised employees, 201 compromised users, 259 third-party employee credentials, 134 external attack surface records.
- No ransom demand, no data sample, no file listing, no proof-of-encryption and no deadline are present in the indexed content.
The credential panel is the only technically actionable element and it is not an intrusion artefact. Hudson Rock panels are built from infostealer log corpora, meaning the counts describe credentials found in stealer logs that reference the victim's domain, not credentials the ransomware operator necessarily used. The 259 third-party employee credentials are the more interesting number: they indicate credentials belonging to staff of other organisations who hold accounts touching t-systems.com infrastructure, which is a supply-chain credential exposure rather than a T-Systems internal compromise. Treat the panel as an exposure indicator, not as evidence of the intrusion path.
The same actor's other postings in the corpus are all German-speaking and all in the same window: lbb-treuhand.de (tax, audit, accounting, payroll), cenesco.de (SME IT solutions, founded 1998), wdk.de (Frankfurt-based manufacturers' association, founded 1950), and lfgholding.com (Swiss wealth-management holding). The pattern is consistent with an actor working a German-language target set, but five leak-site postings are not enough to establish targeting logic, and none of the postings carry technical detail.
Unconfirmed and single-sourced: everything above rests on ransomware.live's index and the Hudson Rock panel it embeds. The "safepay" name is self-assigned by the operator. There is no MITRE ATT&CK profile for it, no independent vendor reporting in the supplied material, and no corroboration that the group exists as a distinct entity rather than a rebrand of an existing operation. Do not treat the group name as an attribution.
4. Mitigation & containment
P1 within 24h
- Determine whether your organisation contracts any T-Systems group entity for ICT services. If yes, request the provider's incident status in writing and record the response; do not rely on the leak-site posting as the status.
- Search your identity provider and VPN logs for authentication from the T-Systems domain space and for accounts belonging to T-Systems staff or contractors. The 259 third-party credential figure means supplier-side accounts are the exposure to check, not only your own staff.
- If you hold accounts with any of the other named victims (lbb-treuhand.de, cenesco.de, wdk.de, lfgholding.com), rotate credentials for those accounts and review recent access.
P2 within 72h
- Run your stealer-log exposure check against your own domain and against the domains of your critical suppliers. The Hudson Rock panel format is the model: employees, users, third-party credentials. Any hit on a supplier domain is a supply-chain finding.
- Enforce phishing-resistant MFA on any externally reachable service that accepts credentials from a supplier organisation. Password rotation alone does not close a stealer-log exposure.
- Confirm offline, tested backups for any system whose availability depends on the named provider. This is a standing control; the listing is the trigger to verify it rather than assume it.
P3 within 7 days
- Revisit the ICT concentration assessment for the T-Systems group if your outsourcing is concentrated there (DORA Art. 29).
- Review the contractual incident-notification clause with the provider (DORA Art. 30 scope) and confirm the notification timeline you are actually entitled to, not the one you assumed.
- Add the named victim domains to your third-party watchlist so a future posting triggers review without a manual search.
No vendor fix, patch or version pin applies. This is a leak-site listing, not a vulnerability disclosure.
5. Indicators of compromise
No atomic indicators (hashes, domains, IPs, file paths, registry keys) are present in the source material. The source provides victim identity and credential-exposure counts only.
| type | value | confidence | source |
|---|---|---|---|
| victim-domain | t-systems[.]com | confirmed (indexed) | ransomware.live |
| victim-domain | lbb-treuhand[.]de | confirmed (indexed) | ransomware.live |
| victim-domain | cenesco[.]de | confirmed (indexed) | ransomware.live |
| victim-domain | wdk[.]de | confirmed (indexed) | ransomware.live |
| victim-domain | lfgholding[.]com | confirmed (indexed) | ransomware.live |
These are victim domains, not attacker infrastructure. They are listed for watchlist matching only and must not be blocked or treated as malicious.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Authentication attempts using credentials matching supplier staff accounts | IdP, VPN, SSO logs | low; inferred from the credential panel, not observed |
| Credential-stuffing pattern against externally reachable services | WAF, IdP failed-auth metrics | low; inferred, no source confirmation |
| Leak-site posting referencing your domain or a supplier domain | ransomware.live index, third-party monitoring | medium; the index is the source of this item |
The credential counts (33 employees, 201 users, 259 third-party credentials, 134 external attack surface records) are single-sourced to the Hudson Rock panel embedded in the ransomware.live entry. Verify before enforcement.
6. Detection
Insufficient indicators to author detection rules.
The source contains no file hashes, no command-line strings, no mutex or scheduled-task names, no ransom-note text, no registry keys and no network artefacts. The only strings available are victim domain names and the operator's self-assigned group name, neither of which is an artefact of the threat itself; a rule built on them would detect reporting about the incident, not the incident. Detection effort should go to the behavioural indicators in §5, which are log-side queries rather than signature content.
7. Sources
- Ransomware.live, "Ransomware: safepay named t-systems.com (DE)", https://www.ransomware.live/id/dC1zeXN0ZW1zLmNvbUBzYWZlcGF5, published 2026-10-05.
- Ransomware.live, "Ransomware: safepay named lbb-treuhand.de (DE)", https://www.ransomware.live/id/bGJiLXRyZXVoYW5kLmRlQHNhZmVwYXk.
- Ransomware.live, "Ransomware: safepay named cenesco.de (DE)", https://www.ransomware.live/id/Y2VuZXNjby5kZUBzYWZlcGF5.
- Ransomware.live, "Ransomware: safepay named wdk.de (DE)", https://www.ransomware.live/id/d2RrLmRlQHNhZmVwYXk.
- Ransomware.live, "Ransomware: safepay named lfgholding.com (CH)", https://www.ransomware.live/id/bGZnaG9sZGluZy5jb21Ac2FmZXBheQ.
- Ransomware.live, "Ransomware: unsafe named Deutsche Bank (DE)", https://www.ransomware.live/id/RGV1dHNjaGUgQmFua0B1bnNhZmU=.
- Ransomware.live, "Ransomware: medusalocker named T Online (DE)", https://www.ransomware.live/id/VCBPbmxpbmVAbWVkdXNhbG9ja2Vy.
8. Adverse Trace position
We assess this as a low-confidence, single-sourced leak-site listing with no technical corroboration and no confirmed actor attribution; "safepay" has no MITRE ATT&CK profile in our reference data and we do not treat the name as an established group. The client impact is indirect: the risk to EMEA financial services clients runs through the supply chain, specifically through any outsourcing relationship with the T-Systems group and through the 259 third-party employee credentials reported in the panel, which is a supplier-credential exposure rather than a client-system compromise. We will monitor the ransomware.live index for further "safepay" postings and for any technical detail, sample or proof-of-encryption that would raise confidence, and we will re-issue this advisory if a client confirms its own systems were reached through the named provider. Clients should treat the credential counts as an exposure indicator to verify against their own logs, not as a confirmed intrusion path.
Published via PulseTrace — Adverse Trace threat intelligence.