safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
Victims · 7d
20▲20 vs prev. week
Victims · 30d
22active targets
Victims · 90d
72
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
Tactics & tooling
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
Estimated earnings
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| marlinhvac.com | · just now | Founded in 1989 by Michael and Richard Pellino, the company has developed more than three decades of experience in mechanical … |
| neumerkel-gmbh.de | · just now | The business traces its origins to 1963 and has operated under the Neumerkel GmbH name since 1994. Its product portfolio … |
| triniticaring.org | · just now | The organization is jointly owned by Guardian Angels Senior Services of Elk River and Cassia, an Augustana/Elim affiliation. Its headquarters … |
| laconcepcion.com.mx | · just now | The organization identifies itself as one of the principal private healthcare providers in the region and serves patients from Coahuila … |
| meterex.com | · just now | The company is headquartered in Langenfeld, North Rhine-Westphalia, and is legally registered as Karl Kuntze (GmbH & Co.), HRA 16336 … |
| stoecklin-kuechen.ch | · just now | The company is based in Aesch near Basel and has developed from a traditional carpentry business founded by Ernst Stöcklin … |
| ryomo.co.jp | · just now | Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … |
| ara-lyss.ch | · just now | Its headquarters and main wastewater-treatment facility are located at Industriering 28 in Lyss. The organization also operates the ARA Messen … |
| gob.pe | · just now | It serves as the country's primary online point of contact between public institutions and citizens, providing government information, administrative procedures, … |
| compunnel.com | · 3d ago | The company provides a combination of talent acquisition, IT consulting, digital engineering, artificial intelligence, cybersecurity, and workforce management services to … |
| gayafores.es | · 6d ago | The company is headquartered in Onda, Castellón, one of Europe's most important ceramic manufacturing regions. Established in 1949, Gayafores has … |
| cenmar-manila.com | · 6d ago | The company was registered with the Philippine Securities and Exchange Commission in 1997 and received authorization to operate as a … |
| gsngestion.es | · 6d ago | The company is based in Villaviciosa de Odón, Madrid, and operates through the GSN Gestión brand. Its website states that … |
| hbpro.pt | · 6d ago | Established in 1994, the company has more than three decades of experience providing technology products, infrastructure, consulting, maintenance, and technical … |
| recoverycafe.org | · 6d ago | The organization was founded in 2003 and opened its first physical café in Seattle in 2004. Its approach is based … |
| mcnishsteel.com | · 6d ago | The company is headquartered in Edmonton, Alberta, and was founded in 1978 by William and Wallace McNish. It has developed … |
| palmettoeyeinstitute.com | · 6d ago | The practice was founded by Dr. Prat Itharat, a board-certified ophthalmologist who specializes in cataract surgery and comprehensive eye care. … |
| reichenau.at | · 6d ago | The official website, reichenau.at, serves as the municipality's central digital information and service platform for residents, businesses, and visitors. The … |
| cannonpuntana.com | · 6d ago | The company operated in Argentina and was historically connected with the manufacture and distribution of fragrances, toiletries, and personal-care products. … |
| assiprime.it | · 6d ago | The company provides insurance brokerage, risk-management, financial consulting, and related assistance services to private individuals, businesses, professionals, artisans, and commercial … |
| industry.airliquide.kr | · 20d ago | Air Liquide has operated in South Korea for several decades and supplies essential gases and related technologies to major industries, … |
| lagegepesca.it | · 22d ago | Based in Lallio, near Bergamo in Lombardy, the company traces its origins to 1957, when Santo Gavazzi established a small … |
| granjarinya.com | · Aug 14, 2026 | Headquartered in Albal, Valencia, the family-owned company traces its origins to three generations of livestock farming. What began as a … |
| azn.co.jp | · Aug 4, 2026 | Founded in 1991, the company specializes in comprehensive asset management, inheritance planning, business succession consulting, real estate advisory services, and … |
| southshorerecycling.com | · Aug 4, 2026 | The company specializes in metal recycling, concrete and asphalt recycling, aggregate production, and construction waste processing for commercial, industrial, and … |
| cpu-ag.com | · Aug 4, 2026 | Founded in 1981 and headquartered in Friedberg, Bavaria, the company has more than four decades of experience developing specialized software … |
| multiaqua.com | · Aug 4, 2026 | Founded in 1999, the company specializes in the design, engineering, and production of air-cooled water chillers, heat pump chillers, hydronic … |
| pradotuylaw.com | · Aug 4, 2026 | The firm focuses on practice areas including personal injury, wrongful death, workplace harassment, business litigation, civil settlements, and environmental litigation. … |
| naskdoorinc.com | · Aug 4, 2026 | Headquartered in West Chester, Pennsylvania, the company has served customers throughout southeastern Pennsylvania and northern Delaware for several decades. Although … |
| new-point.it | · Aug 4, 2026 | Headquartered in Signa, Florence, Italy, the company was founded in 2006 and has grown into one of Italy's established suppliers … |
| simonrack.com | · Aug 4, 2026 | Headquartered in Alfamén, Zaragoza, Spain, the company has been manufacturing metal shelving since 1964 and has become one of Europe's … |
| hanan-hov.co.il | · Aug 4, 2026 | Headquartered in Neve Yamin, Israel, the company provides comprehensive logistics support for construction, infrastructure, industrial, and commercial projects throughout the … |
| haugbuersten.de | · Jul 27, 2026 | Although the company in its current industrial form was founded in 1962, its family-owned brush-making tradition dates back to 1836, … |
| landesmuseum.de | · Jul 27, 2026 | Established in 1919, the museum preserves and presents more than 50,000 years of human cultural history, ranging from prehistoric artifacts … |
| hst.eu | · Jul 27, 2026 | Headquartered in Kressbronn am Bodensee, Germany, the company traces its mechanical engineering heritage back to 1950, while the original tea … |
| braywoodschool.co.uk | · Jul 27, 2026 | Founded in 1858, the school has more than 165 years of educational history and serves children from early years through … |
| weier.org | · Jul 27, 2026 | The company specializes in representing manufacturers of plumbing, heating, water treatment, pumping, drainage, and building services equipment throughout western Germany. … |
| bnpdist.com | · Jul 27, 2026 | Headquartered in New York City, the company has been operating since 1979 and supplies restaurants, hotels, retailers, and wine merchants … |
| zinorm.de | · Jul 27, 2026 | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … |
| moebelmayer.de | · Jul 27, 2026 | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … |
| paritaet-nrw.org | · Jul 27, 2026 | Headquartered in Wuppertal, the organization represents approximately 3,100 legally independent member organizations operating more than 7,000 social institutions and services … |
| upland.k12.ca.us | · Jul 24, 2026 | The district provides comprehensive education from kindergarten through twelfth grade and operates 14 schools, including elementary, junior high, and high … |
| gvsurgicalarts.com | · Jul 24, 2026 | Founded in 2004 by Dr. Brian R. Chisdak, the practice has grown into one of Montana's leading surgical centers and … |
| wdk.de | · Jul 20, 2026 | Founded in 1950 and headquartered in Frankfurt am Main, the organization serves as the central voice of German manufacturers of … |
| jaecklin-industrial.de | · Jul 20, 2026 | Founded in 1935 by Julius Jäcklin, the company has developed from a regional machine repair workshop into a globally recognized … |
| lbb-treuhand.de | · Jul 20, 2026 | The company specializes in tax consulting, auditing, accounting, payroll administration, financial reporting, and business advisory services for private individuals, self-employed … |
| timetex.de | · Jul 20, 2026 | The company traces its origins to 1991, when the TimeTEX brand was acquired and expanded into a comprehensive supplier of … |
| stroebel-gruppe.de | · Jul 20, 2026 | Headquartered in Langenzenn, Bavaria, the company was founded in 1978 by Gerlinde and Gerhard Ströbel and has grown from a … |
| industriesjaro.com | · Jul 20, 2026 | Over several decades, Jaro has evolved from manufacturing telephone booths into a supplier of advanced outdoor enclosures, interactive kiosks, bus … |
| cenesco.de | · Jul 20, 2026 | Founded in 1998, the company provides comprehensive information technology solutions for small and medium-sized enterprises (SMEs), helping organizations modernize their … |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .