safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
Victims · 7d
10flat
Victims · 30d
22active targets
Victims · 90d
67
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
Tactics & tooling
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
Estimated earnings
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| moorelumber.com | · Dec 29, 2025 | Moore Lumber & Hardware Co. is a U.S. building-materials retailer and hardware supplier based in Ayer, Massachusetts. Founded in the … |
| usdaw.org.uk | · Dec 29, 2025 | Usdaw — formally the Union of Shop, Distributive and Allied Workers — is one of the United Kingdom’s largest and … |
| investigacionesmedicas.com | · Dec 29, 2025 | Investigaciones Médicas is a private medical diagnostics and imaging services provider based in Buenos Aires, Argentina. Founded in 1991, it … |
| sproutnet.com | · Dec 29, 2025 | SproutNet — operating under International Specialty Supply — is a U.S. producer and supplier of sprouting seeds, sprouts, natural ingredients … |
| precisionaluminum.ca | · Dec 29, 2025 | Precision Aluminum Manufacturing Inc. is a Canadian metal fabrication and architectural products company headquartered in Rocky View County (near Calgary), … |
| estrumar.es | · Dec 29, 2025 | Metálicas Estrumar is a Spanish metal fabrication and structural engineering company headquartered in Burgos, Castilla y León, Spain. It is … |
| pau.at | · Dec 29, 2025 | PAUAT Architekten is a regional architectural practice based in Wels, Austria, founded in 1999 and led by architect Heinz Plöderl. … |
| heatcel.co.uk | · Dec 27, 2025 | Heatcel is a UK-based specialist supplier of central heating spares, components and equipment, operating as a stockist and distributor for … |
| ryc.org | · Dec 27, 2025 | Raritan Yacht Club (RYC) is a private, member-owned recreational club located in Perth Amboy, New Jersey, with a history dating … |
| studioelad.it | · Dec 27, 2025 | Studio Elad — legally registered as Elad S.r.l. — is an Italian company operating in the professional services and business … |
| debralmorrison.com | · Dec 27, 2025 | Debra L. Morrison operates a professional coaching, speaking, and financial education practice associated with the domain DebraLMorrison.com, which serves as … |
| hmpccpa.com | · Dec 27, 2025 | Harvey & Martin, PLLC is a professional accounting firm based in Massachusetts, United States, with additional offices in Gloucester, MA … |
| vanvenrooy.com | · Dec 27, 2025 | Van Venrooy is a Dutch family-owned engineering and manufacturing company based in Oss, the Netherlands, that specialises in tailor-made utility … |
| wadzeck-stiftung.de | · Dec 27, 2025 | Wadzeck-Stiftung is one of Germany’s oldest charitable youth-welfare organisations, founded in 1819 in Berlin as the first evangelical orphanage in … |
| inpipeproducts.com | · Dec 27, 2025 | iNPIPE PRODUCTS is a British engineering and manufacturing company headquartered in Brompton on Swale, North Yorkshire, United Kingdom. The firm … |
| larosadelmonte.com | · Dec 27, 2025 | La Rosa Del Monte is a long-standing family-owned moving and logistics company based in Bronx, New York, with operations extending … |
| polhun.pl | · Dec 24, 2025 | POL-HUN is a well-established Polish manufacturer and distributor of household cleaning products and consumer chemicals. Founded in 1990, the company … |
| maxdream.tur.ar | · Dec 24, 2025 | Maxdream is an Argentine travel and tourism company headquartered in Buenos Aires, Argentina, that specialises in organising student travel experiences … |
| 47club.jp | · Dec 24, 2025 | 47CLUB (operated by Kabushiki Kaisha 47CLUB, or 株式会社47CLUB) is a Japanese e-commerce and regional marketing company based in Tokyo. Its … |
| nhpsa.com.ar | · Dec 24, 2025 | NHPSA — formally New High Pack S.A. — is an Argentine packaging manufacturer and supplier based in Benavídez, Tigre, Province … |
| vitatrac.com.gt | · Dec 24, 2025 | Vitatrac S.A. is a long-established automotive service and tire distribution company headquartered in Guatemala City, Guatemala, with multiple service centers … |
| eiconnect.com | · Dec 24, 2025 | Electronic Interconnect, often referred to as EI, is a U.S.-based manufacturer and supplier of printed circuit boards (PCBs) headquartered in … |
| massfd.org | · Dec 24, 2025 | MassFD — as reflected by the domain massfd.org — appears to be the official website of the Massapequa Fire District, … |
| cmac-llc.com | · Dec 24, 2025 | cMAC LLC is a small, privately-held construction and general contracting firm based in Renton, Washington, serving residential and commercial clients … |
| envases-group.com | · Dec 24, 2025 | Envases Group is a privately held multinational packaging manufacturer and solutions provider with deep roots in the global containers and … |
| pellcityschools.net | · Dec 23, 2025 | Pell City Schools is a public K-12 school district based in Pell City, Alabama, serving students from pre-kindergarten through 12th … |
| rogitz.com | · Dec 20, 2025 | Rogitz & Associates was a small intellectual property law firm based in San Diego, California, specialising in patent prosecution, patent … |
| reger-zahntechnik.de | · Dec 20, 2025 | Reger Zahntechnik, formally registered in Nuremberg (Nürnberg), Germany as Walter Reger Zahntechnisches Labor GmbH, is a traditional dental laboratory specialising … |
| springersjewelers.com | · Dec 20, 2025 | Springer’s Jewelers is a historic family-owned jewelry retailer based in Portland, Maine, with additional store locations in Bath, Maine and … |
| dfcsystems.de | · Dec 20, 2025 | DFC-SYSTEMS GmbH is a German software and technology company headquartered in Munich that specialises in clinical documentation and digital workflow … |
| kenalex.ca | · Dec 20, 2025 | Kenalex Construction Co. Ltd. is a Canadian construction and development firm headquartered in North Bay, Ontario, serving Central and Northern … |
| meyer-lift.de | · Dec 20, 2025 | Meyer Lift GmbH is a German equipment rental company headquartered in Hohenwestedt, northern Germany. It specialises in the rental and … |
| coloradopowerline.com | · Dec 20, 2025 | Colorado Powerline, Inc. (often abbreviated CPI) is a U.S. electrical infrastructure construction company headquartered in Sedalia, Colorado. Founded in 2006, … |
| peus-muenzen.de | · Dec 20, 2025 | Peus Münzen, officially Dr. Busso Peus Nachfolger e.K., is one of Germany’s oldest and most prestigious coin dealers and numismatic … |
| capsum.com | · Dec 20, 2025 | Capsum is a global beauty and cosmetics contract manufacturer that specialises in microfluidic technology, a patented scientific process that allows … |
| seguriamericas.com | · Dec 17, 2025 | SeguriAmericas, formally known as Seguridad Las Americas Ltda, is a Colombian company specialising in private security and investigation services. Founded … |
| smilecenterutah.com | · Dec 17, 2025 | Smile Center Utah is a private dental practice located in Provo, Utah, providing comprehensive oral healthcare services to patients of … |
| silverlinegroupinc.com | · Dec 17, 2025 | Silverline Group Inc. is a Canadian construction and civil contracting firm based in St. Catharines, Ontario. It operates in the … |
| notar-gerresheim.de | · Dec 17, 2025 | Notare Dr. Heinrich & Dr. Berg is a private notary office located in the Gerresheim district of Düsseldorf, Germany. The … |
| artcitydental.com | · Dec 17, 2025 | Art City Dental is a family-oriented dental clinic located in Springville, Utah, within the United States. The practice provides a … |
| gandlmechanical.com | · Dec 17, 2025 | G & L Mechanical Contractor, L.P. is a regional mechanical contracting firm based in Grapevine, Texas, and has been operating … |
| zimeda.eu | · Dec 17, 2025 | Zimeda GmbH & Co. KG is a German medical technology and healthcare supplier headquartered in Passau, Bavaria. The firm operates … |
| aspenviewacademy.org | · Dec 17, 2025 | Aspen View Academy is a charter school located in Castle Rock, Colorado, serving students from pre-kindergarten through 8th grade. Founded … |
| feldmanandlopez.com | · Dec 17, 2025 | Feldman & Lopez, P.A. is a law firm based in Miami, Florida, that specialises in property insurance law and related … |
| hoodriverdentist.com | · Dec 17, 2025 | Hood River Dental is a private dental practice located in Hood River, Oregon, providing comprehensive oral healthcare services to individuals … |
| seeberger-appel.de | · Dec 17, 2025 | Seeberger Appel is a German law firm specialising in commercial law, corporate law, employment law, and civil litigation, with a … |
| stadtwerke-clausthal.de | · Dec 17, 2025 | Stadtwerke Clausthal-Zellerfeld is a municipal utility company (Stadtwerk) serving the town of Clausthal-Zellerfeld in Lower Saxony, Germany. As a publicly … |
| autohaus-paschke.de | · Dec 17, 2025 | Autohaus Paschke is a German automobile dealership and automotive service provider that operates primarily in the regional car retail and … |
| ernst-auto.de | · Dec 17, 2025 | Ernst Autohaus is a German automotive dealership and service company operating in the regional vehicle retail market. The business is … |
| teccart.qc.ca | · Dec 15, 2025 | Founded in 1945, the institution has a long history of delivering practical, career-focused education in technology, design, business, management, arts, … |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .