safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
Victims · 7d
10flat
Victims · 30d
22active targets
Victims · 90d
67
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
Tactics & tooling
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
Estimated earnings
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| ettp.be | · May 7, 2026 | Appears to be a Belgian-based entity likely involved in professional training, technology consulting, or industrial services. While detailed public data … |
| studioubertazzi.it | · May 7, 2026 | Is an Italian firm that likely operates in the field of professional services such as architecture, design, or engineering consulting. … |
| globalmerchservices.com | · May 7, 2026 | Global Merchandising Services (GMS) is an international entertainment merchandising company founded in 2008. It specializes in developing and managing merchandise … |
| soavegel.it | · May 7, 2026 | Is an Italian food manufacturing company specializing in frozen gastronomic products. Founded in 1935 in Francavilla Fontana, the company has … |
| smp.cat | · May 7, 2026 | Is a private healthcare organization based in Catalonia, Spain, operating in the Hospitals & Physicians Clinics sector. Founded in 1993 … |
| gingerichtrucking.com | · May 7, 2026 | Is a U.S.-based freight transportation company operating primarily in interstate logistics. The company specializes in hauling general freight, agricultural products … |
| jmige.com | · May 7, 2026 | JMIGE appears to be a company with limited publicly available information, making precise classification difficult. Based on naming conventions and … |
| hokuyo2006.co.jp | · May 4, 2026 | Is a Japanese company that operates as part of a larger industrial group connected to packaging, logistics, and housing-related businesses. … |
| bootstransport.ca | · May 4, 2026 | Is a Canadian transportation and logistics company specializing in freight delivery and supply chain services. The company primarily operates in … |
| dahlgrenscement.se | · May 4, 2026 | Is a Swedish company operating in the construction materials sector, particularly focused on cement and related building products. Companies in … |
| maiadouro.pt | · May 4, 2026 | Appears to be a Portuguese company connected to the Douro region, which is internationally known for wine production and agriculture. … |
| zonaovest.to.it | · May 4, 2026 | Is likely an Italian regional organization or consortium based in the Turin (Torino) area. Entities with similar naming conventions in … |
| fital-treppenlifte.de | · May 4, 2026 | Is a German company specializing in stairlifts and mobility solutions for individuals with reduced mobility. The company operates in the … |
| energyaction.com.au | · May 1, 2026 | Is an energy management and consulting company that helps businesses reduce their energy costs and carbon emissions. Its main services … |
| hpk.hamburg | · May 1, 2026 | Is a Hamburg-based, family-run international trading company with over 50 years of experience, specializing in premium meat and seafood imports. … |
| favellefavco.com | · Apr 16, 2026 | Favelle Favco is a leading manufacturer of heavy-duty cranes, including: - tower cranes - offshore cranes - wharf and marine … |
| st-bernards.bham.sch.uk | · Apr 16, 2026 | St Bernard’s provides primary education for children, including: English, maths, science and general curriculum subjects Religious education (Catholic values are … |
| bbalawgroup.com | · Apr 16, 2026 | Also referred to as BBA Immigration, is a boutique U.S. legal practice headquartered in Houston, Texas, specialising in immigration law … |
| firstcambodia.com.kh | · Apr 16, 2026 | First Cambodia Co., Ltd. is a leading IT services and system integration company headquartered in Phnom Penh, Cambodia. Founded in … |
| cheeky.com.ar | · Apr 16, 2026 | Cheeky is a well-established Argentine children’s fashion brand owned by CHEEK S.A., headquartered in Martínez, Buenos Aires Province. Founded in … |
| abfall-kreis-kassel.de | · Apr 16, 2026 | The website abfall-kreis-kassel.de represents the Abfallentsorgung Kreis Kassel, a publicly owned waste management entity (Eigenbetrieb) operated by the district of … |
| genealogysa.org.au | · Apr 16, 2026 | Genealogy SA, formally known as the South Australian Genealogy & Heraldry Society, is a leading Australian nonprofit organisation dedicated to … |
| lynxprecast.co.uk | · Apr 16, 2026 | Lynx Precast Ltd is a UK-based construction manufacturing company specialising in the design, manufacture and installation of precast concrete products … |
| thruwayplumbingservice.com | · Apr 16, 2026 | The business provides standard residential and commercial plumbing services, including: - Leak detection and pipe repair - Drain cleaning and … |
| academyhealth.org | · Apr 6, 2026 | Is a U.S.-based nonprofit professional organization headquartered in Washington, D.C., dedicated to advancing the fields of health services research and … |
| brookercg.com | · Mar 17, 2026 | Is a privately held general contracting and construction management company headquartered in Chattanooga, Tennessee, United States. The firm specializes in … |
| tiefenbachergroup.com | · Mar 17, 2026 | Is a 100% family-owned, leading global healthcare company founded in 1963 and based in Hamburg, Germany. The company operates across … |
| briwaycarriers.com | · Mar 17, 2026 | Ontario-based transportation company specializing in specialized freight, including a dedicated glass division and agricultural services. They offer global supply chain … |
| mattandsteve.com | · Mar 17, 2026 | Is a Canadian food manufacturer based in Mississauga, Ontario, founded in 2000 by Matthew Larochelle and Steve McVicker. Known for … |
| thenavigatorcompany.com | · Mar 17, 2026 | Is a major Portuguese producer of forestry, pulp, paper, tissue, and sustainable packaging solutions, recognized as Europe's largest manufacturer of … |
| smileteam.com.au | · Mar 6, 2026 | Is a privately owned Australian healthcare company specialising in orthodontic treatment and dental alignment services. The organisation was founded around … |
| Franz-Sales-Haus.de | · Mar 3, 2026 | Located at Steeler Straße 261, 45138 Essen, is a support organization dedicated to empowering people with disabilities to live self-determined … |
| ripobec.com | · Mar 3, 2026 | Is a Canadian family-owned agricultural supply company headquartered in Saint-Apollinaire, Quebec, specialising in the production and distribution of premium wood … |
| atadler.com.sg | · Feb 7, 2026 | Is a Singapore-based accounting, auditing and bookkeeping services firm that has been operating as a registered partnership since 25 October … |
| kres.cz | · Feb 7, 2026 | Czech small-to-medium enterprise headquartered in Krnov – Pod Cvilínem, Czech Republic. The company specialises in the sale, repair and servicing … |
| groupepiche.ca | · Feb 7, 2026 | Is a privately held Canadian construction and interior systems company headquartered in Ferme-Neuve, Québec with additional offices in Boisbriand (QC), … |
| freidarothman.com | · Jan 26, 2026 | Based jewelry and accessories brand founded and led by designer Freida Rothman, who grew up in Brooklyn and comes from … |
| gsglobalresources.com | · Jan 24, 2026 | GS Global Resources (often abbreviated GSGR) is an American industrial engineering and machine-performance solutions company headquartered in Mukwonago, Wisconsin. Founded … |
| lcpublishinggroup.com | · Jan 24, 2026 | LC Publishing Group S.p.A. is an international digital publishing and information services company headquartered in Milan, Italy. Founded in 2011, … |
| adifse.com.ar | · Jan 24, 2026 | ADIFSE — formally the Administración de Infraestructuras Ferroviarias Sociedad del Estado — is a state-owned railway infrastructure company in Argentina … |
| trulinemfg.com | · Jan 24, 2026 | Tru-Line Manufacturing Company is an American industrial fabrication firm headquartered in Decatur, Alabama that specialises in the metal fabrication of … |
| superiordrywall.com | · Jan 24, 2026 | Superior Drywall is an established American commercial drywall contracting company based in Oxnard, California, specialising in a range of interior … |
| interr.com | · Jan 24, 2026 | Interr is a privately held security and risk-management services company headquartered at The Loom, 14 Gower’s Walk, London, UK. Established … |
| rlc.es | · Jan 23, 2026 | RLC Transportes (operating under Rau Load Cargo, S.L.) is a Spanish logistics and freight-transport company based in El Puig de … |
| wohnverbund-st-gertrud.de | · Jan 19, 2026 | Wohnverbund St. Gertrud is a German social care and residential support organisation located in Morsbach, North Rhine-Westphalia, Germany. It operates … |
| ipu.co.il | · Jan 19, 2026 | IPU Industries Ltd. is a privately held Israeli industrial manufacturing company headquartered in Kiryat Gat, Israel, specialising in advanced plastic … |
| abcseamless.com | · Jan 19, 2026 | ABC Seamless is a U.S.-based home improvement and exterior construction company that specialises in custom on-site manufactured seamless steel siding, … |
| setex-textil.de | · Dec 29, 2025 | SETEX-Textil GmbH is a vertically integrated German textile manufacturer headquartered in Hamminkeln-Dingden, North Rhine-Westphalia. The company operates comprehensive textile production … |
| davidrosenbakerysupply.com | · Dec 29, 2025 | David Rosen Bakery Supply is a long-established wholesale bakery supply and distribution company headquartered in Maspeth, New York, serving commercial … |
| knightgroup.co.uk | · Dec 29, 2025 | Knight Group is a UK-based precision metal stockist and processor with a long history dating back to 1943. The company … |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .