Skip to content
Leak-site post naming bwi-bau.de, captured by ThreatCluster

bwi-bau.de

safepay

Ransomware leak-site victim intelligence · DE

Views
4,151
Posted
Oct 5, 2026
Country
DE
Industry
construction economics and management

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

The leak post claims BWI-Bau GmbH – Institut der Bauwirtschaft (bwi-bau.de) in Düsseldorf, Germany is the victim. It does not specify what data were taken or how much, and only provides victim details such as domain and headquarters. The post was posted on 2026-10-05 and is listed on the leak site, with a note that the link will be added soon.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Founded
1964
Domains
bwi-bau.de

What was taken

The organization was established in October 1964 as a subsidiary of the Construction Industry Association of North Rhine-Westphalia. It originally …

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

The link will be added soon.
true

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture