safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
Victims · 7d
14▲8 vs prev. week
Victims · 30d
22active targets
Victims · 90d
72
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
Tactics & tooling
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
Estimated earnings
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| acsmallmaxwell.com.au | · Jul 20, 2026 | Founded in 1916 by Ambrose Cecil Small, the firm has provided professional accounting and financial services to businesses and individuals … |
| mende-grundbesitz.de | · Jul 20, 2026 | Founded in 1994, the company specializes in the professional administration of residential, commercial, and mixed-use real estate throughout the Berlin … |
| shuttlemeadowcc.com | · Jul 13, 2026 | Founded in 1917, the club is one of the oldest and most prestigious private golf clubs in New England. It … |
| hahn-airport.de | · Jul 6, 2026 | Originally developed as a United States military air base, the facility began civilian operations in 1993 and has since become … |
| matrixwebagency.com | · Jul 6, 2026 | The company specializes in providing integrated digital solutions that help businesses improve their online visibility, customer engagement, and revenue growth. … |
| bmiprojects.de | · Jul 6, 2026 | Originally operating under the name Bez Marine Interiors GmbH, the company built on decades of experience in the maritime industry … |
| caritas-koblenz.de | · Jul 6, 2026 | Headquartered in Koblenz, the association was founded in 1918 and has provided charitable and community-based services for more than a … |
| knobel-bau.de | · Jul 6, 2026 | Founded in 1947, the company has grown from a small sand and gravel business established after the Second World War … |
| rtngmbh.de | · Jul 6, 2026 | Founded in 2015, the company specializes in the construction, installation, maintenance, and rehabilitation of underground utility networks and civil engineering … |
| stedwardscatholicfirstschool.co.uk | · Jul 6, 2026 | The school provides education for children aged 5 to 9 years and operates as a Voluntary Aided School under the … |
| lh-wohnverbund-wohnen-nrw.de | · Jul 6, 2026 | They specialize in providing residential care, supported living, and social assistance for children, adolescents, and adults with intellectual and developmental … |
| shw-fr.de | · Jul 6, 2026 | The company traces its origins to 1596, making it one of Germany's oldest industrial manufacturers, although its current corporate structure … |
| awo-suedost.de | · Jul 2, 2026 | Established in 1994, it is one of the regional branches of the Arbeiterwohlfahrt (AWO), one of Germany's six largest independent … |
| dia179.com | · Jul 2, 2026 | Founded in 2007, the firm specializes in industrial architecture, logistics facilities, research centers, production plants, and corporate office buildings. Unlike … |
| eaglecrestlife.org | · Jul 2, 2026 | Operating under Bethany Lutheran Homes, Inc., the organization has served the region since 1946 and is recognized as the largest … |
| hellmold-plank.de | · Jun 27, 2026 | Founded in 1904 by Heinrich Hellmold and Heinrich Plank, the company has evolved from a local cartage business into a … |
| ehg.bayern | · Jun 22, 2026 | Founded in 1991, the company has evolved from a regional waste management enterprise into a specialized provider of infrastructure operations, … |
| seinordovest.it | · Jun 17, 2026 | Headquartered in the Piedmont region, the company operates as a public utility serving numerous municipalities in northwestern Italy. Its mission … |
| harcourts.net | · Jun 17, 2026 | Founded in 1888 in Wellington, New Zealand, the company has grown from a local real estate agency into a global … |
| zaunsysteme.de | · Jun 17, 2026 | Operating within Germany’s construction materials and perimeter security sector, the company provides a wide range of products, including double-wire mesh … |
| brscappuccio.it | · Jun 17, 2026 | Headquartered in Casandrino, near Naples in the Campania region, the company specializes in the distribution and supply of medical devices, … |
| gut-heckenhof.de | · Jun 17, 2026 | Established in 1992, the company operates a four-star hotel and one of the largest golf facilities in the region. The … |
| hughstirling.co.uk | · Jun 15, 2026 | Headquartered in Goslar, Lower Saxony, the firm has been operating since 1975 and has expanded its presence through additional offices … |
| tokyocivil.co.jp | · Jun 15, 2026 | Established in 2020, the company specializes in public infrastructure and civil engineering projects, serving primarily the Tokyo metropolitan area and … |
| kawaius.com | · Jun 15, 2026 | Founded in Japan in 1927 by Koichi Kawai, the company has established a reputation for combining traditional Japanese craftsmanship with … |
| musenet.co.jp | · Jun 15, 2026 | Founded in the twentieth century, the company serves as an intermediary between publishers and music retailers throughout Japan. Its online … |
| bautz-maschinenbau.de | · Jun 15, 2026 | Founded in 1960 by Alfred Bautz, the family-owned enterprise has developed over three generations into a specialized supplier of precision … |
| aquaclean.com | · Jun 15, 2026 | The company operates as part of Interfabrics S.L. and has more than 50 years of experience in the textile industry. … |
| hoodriversheriff.com | · Jun 15, 2026 | Headquartered in Hood River, the organization provides a broad range of services, including patrol operations, criminal investigations, emergency communications, search … |
| iql-nog.com | · Jun 2, 2026 | Founded in 1947, the company specializes in the production of oleochemical products, particularly fatty acid esters and specialty chemicals derived … |
| verzolla.com | · Jun 1, 2026 | Founded in 1958 (with the current corporate structure established in 2007), the company specializes in supplying industrial components, automation systems, … |
| compactmould.com | · Jun 1, 2026 | Founded in 1978 and headquartered in Woodbridge, Ontario, the company has grown into one of North America’s major suppliers of … |
| tavolaspa.com | · Jun 1, 2026 | Over more than seventy years of operation, the company has evolved from an import-export business into a diversified manufacturer, distributor, … |
| parsa-beauty.de | · Jun 1, 2026 | Founded in 1986, the company has become one of Europe’s leading manufacturers and distributors of hair, beauty, and personal care … |
| soraris.it | · Jun 1, 2026 | Founded in 1983, the company specializes in the collection, transportation, treatment, and management of municipal solid waste and recyclable materials. … |
| lcnet.eu | · Jun 1, 2026 | The network was established to provide integrated cross-border transport solutions, allowing member companies to coordinate freight movements efficiently throughout Europe. … |
| eitecpro.co.jp | · May 25, 2026 | Founded in 1988 and headquartered in Osaka, the company operates multiple regional offices across Japan, including Tokyo, Yokohama, Nagoya, Sendai, … |
| tme-rusta.de | · May 25, 2026 | The company was originally founded in Munich in 1966 as an artistic metalworking workshop and later expanded into woodworking, plastics … |
| cyuou.com | · May 25, 2026 | Founded in 2000, the company specializes in website development, digital advertising, graphic design, Wi-Fi infrastructure projects, and online business support … |
| vdmtrucking.com | · May 25, 2026 | Headquartered in Edmonton, Alberta, the company has operated for more than 40 years and has developed into a significant regional … |
| olipes.com | · May 19, 2026 | Founded in 1993 and headquartered in Campo Real, Madrid, the company has become an important independent manufacturer in the European … |
| mediafrance.de | · May 18, 2026 | The company operates primarily in France while maintaining media-related partnerships and activities across European markets, including Germany. Its business model … |
| ashleytimber.co.uk | · May 18, 2026 | Founded in 1988, the company operates as a family-run SME and has developed a strong regional presence in the North … |
| harrisoncountywv.com | · May 18, 2026 | The Commission functions as the executive administrative body for the county and is responsible for overseeing public infrastructure, fiscal management, … |
| adlan.com | · May 18, 2026 | Founded in 1995, the company specializes in IT infrastructure, network design, cybersecurity, disaster recovery, and managed technology services for small … |
| printroom.co.uk | · May 18, 2026 | Founded in 1977, the company has evolved from a small blueprint-printing business into a large multi-service print agency serving corporate, … |
| hautarzt-budihardja.de | · May 18, 2026 | The clinic is led by Dr. med. Debby Budihardja, a board-certified dermatologist and allergologist with extensive clinical experience gained at … |
| Berlinmobil.de | · May 18, 2026 | Is a German transportation company headquartered in Berlin, specializing in bus charter services, passenger transportation, school transport, and mobility solutions … |
| id-s.de | · May 7, 2026 | Is a German company operating in the field of digital technologies and IT-related services. Although detailed public information is limited, … |
| mbk-gmbh.de | · May 7, 2026 | Is a German industrial company specializing in metal processing and surface finishing technologies. The company provides services such as galvanizing, … |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .