safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
Victims · 7d
10flat
Victims · 30d
22active targets
Victims · 90d
67
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
Tactics & tooling
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
Estimated earnings
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| sbws.org.sg | · Dec 15, 2025 | Singapore Buddhist Welfare Services (SBWS) is a well-established voluntary welfare organisation (VWO) in Singapore that focuses on holistic, community-based support … |
| fest-group.de | · Dec 15, 2025 | FEST Group is a German engineering and industrial technology company headquartered in Goslar. It specialises in advanced automation, electrification and … |
| lampus.com | · Dec 15, 2025 | R.I. Lampus Company, operating the domain Lampus.com, is a long-established American manufacturer and distributor in the building materials industry. Founded … |
| inttrust.gr | · Dec 15, 2025 | InTTrust S.A. is a Greek information technology and consulting firm headquartered in Agia Paraskevi, Athens. Founded in 2006, the company … |
| aysa.com.ar | · Dec 15, 2025 | AYSA, formally known as Agua y Saneamientos Argentinos Sociedad Anónima, is Argentina’s largest state-owned water and sanitation utility, responsible for … |
| chemstress.com | · Dec 9, 2025 | Since its founding in 1965, the company has combined in-house disciplines — process, mechanical, piping, structural, instrumentation, electrical, and architectural … |
| mmc.de | · Dec 6, 2025 | MMC Studios is a major German media-production and facility company headquartered in Cologne. The firm operates one of Germany’s leading … |
| juliuskoch.com | · Dec 5, 2025 | Julius Koch GmbH is a historic German company founded in 1895 that specialises in the development and manufacture of high-performance … |
| untereisesheim.de | · Dec 5, 2025 | Untereisesheim is a small municipality in the district of Heilbronn in the federal state of Baden-Württemberg, southwestern Germany. It is … |
| steuerberater-scheerer.de | · Dec 5, 2025 | Steuerberater-Scheerer (operating as C. M. Scheerer GmbH) is a German tax-consulting and auditing firm based in Schweinfurt, Bavaria. The practice … |
| mactavishco.ca | · Dec 5, 2025 | MacTavish & Co. is a small Canadian boutique retailer located in Medicine Hat, Alberta, specializing in curated home décor, gifts, … |
| barnet.com.au | · Dec 5, 2025 | BarNet is an Australian specialist communications management organisation focused on serving legal professionals, particularly barristers and associated legal chambers. Founded … |
| wachtmann.eu | · Dec 5, 2025 | Specializing in consumer goods distributed online via a web store. The business model is typical for small e-commerce firms: sourcing … |
| becksgroup.au | · Dec 5, 2025 | Family-owned Australian company established in 1976 that operates within the luxury goods and jewellery industry, focusing on precious metals and … |
| hyperdomemedicalcentre.com.au | · Dec 5, 2025 | Hyperdome Medical Centre is a general practice clinic located in the South.Point shopping centre in Greenway, Tuggeranong, within the Australian … |
| dynamichomerepair.com | · Nov 24, 2025 | Dynamic Home Repair is a U.S.-based company specializing in repair services for manufactured homes. It offers a “lifetime warranty” on … |
| rehmann.de | · Nov 24, 2025 | Furniture-retail company in Velbert, Germany, operating a furniture house and a high-end studio for home furnishings. This company is mid-sized, … |
| istitutocomprensivo-cavaglia.edu.it | · Nov 18, 2025 | Istituto Comprensivo di Cavaglià is a public school district in the Biella province of the Piedmont region, serving students from … |
| puertoricowarehousing.com | · Nov 18, 2025 | Puerto Rico Warehousing Management Corp. is a logistics and storage company based in Carolina, Puerto Rico. It operates a modern … |
| adesursas.com | · Nov 18, 2025 | Adesur SAS is a Colombian company based in Pasto, Nariño, that operates in the wholesale distribution of agricultural and veterinary … |
| aussenwelten.ch | · Nov 18, 2025 | Zuber Aussenwelten AG is a Swiss company based in Domat/Ems (Graubünden), operating in the garden design and outdoor-living sector. The … |
| simmonsbb.com | · Nov 18, 2025 | Simmons Electrical Co. Ltd. is a well-established Barbadian electrical contracting firm headquartered in St. Philip. The company specializes in a … |
| killinglyschools.org | · Nov 14, 2025 | Killingly Public Schools is a K-12 public school district based in Danielson, Connecticut, serving students in the town of Killingly. … |
| confortchem.com & rogitex.com | · Nov 13, 2025 | ConfortChem Inc. is a Canada-based distributor and technical partner specializing in raw materials and machinery for the polyurethane foam industry. … |
| doversd.org | · Nov 12, 2025 | Dover City Schools is a public K-12 school district located in Dover, Ohio, serving approximately 2,650 students across multiple schools. … |
| glendaleobgyn.com | · Nov 11, 2025 | Glendale OBGYN (an obstetrics and gynecology practice) would likely operate as a mid-sized women’s health clinic in Glendale, California, offering … |
| himmelstein.com | · Nov 11, 2025 | S. Himmelstein & Company is a U.S.-based specialist manufacturer founded in 1960, headquartered in Hoffman Estates, Illinois. The company focuses … |
| ielplumbing.com | · Nov 10, 2025 | I.E. Plumbing Services is a privately-held plumbing contractor based in Southern California, operating from two locations in the Riverside / … |
| mcintoshlabs.com | · Nov 5, 2025 | McIntosh Laboratory is an iconic American company, founded in 1949 and headquartered in Binghamton, New York. It specializes in high-end, … |
| holtzofficesupport.com | · Oct 31, 2025 | Holtz Office Support GmbH is a family-owned, medium-sized German company headquartered in Wiesbaden, founded in 1956. The company specializes in … |
| constructiondprovost.com | · Oct 24, 2025 | Construction Donald Provost is a regional general contracting firm established in Mont-Tremblant that specialises in high-quality residential and light-commercial construction, … |
| xortec.de | · Oct 24, 2025 | Xortec GmbH is a German value-added distributor and systems integrator for professional video surveillance, IP network infrastructure and security-tech solutions. … |
| mino-in.co.jp | · Oct 24, 2025 | MINO Group is a long-established Japanese manufacturer (founded 1946) that designs and builds screen-printing machines, stencil makers, dryers, printing accessories … |
| bannenbergandrowell.com | · Oct 24, 2025 | Bannenberg & Rowell is a luxury studio specialising in superyacht exterior and interior design, founded as the direct successor to … |
| greenhouseapt.com | · Oct 24, 2025 | The Greenhouse is an apartment building and management/letting operation in Boston’s Back Bay / South End that offers 1–3 bedroom … |
| healthandvitalitycenter.com | · Oct 19, 2025 | The Health & Vitality Center is a holistic medical practice located at 11600 Wilshire Blvd, Suite 120, Los Angeles, CA. … |
| empirico-mr.com | · Oct 10, 2025 | Empirico Research is a boutique global market-research and data-collection firm founded around 2016. The company combines online panels, telephone interviewing … |
| tango-hotel.com.ar | · Oct 10, 2025 | The Argentina Tango Hotel (often listed as Tango de Mayo / Argentina Tango in booking platforms) is a boutique city … |
| bridgenetcommunicationsrgv.com | · Oct 10, 2025 | BridgeNet Communications is a regional low-voltage and structured-cabling specialist serving the Rio Grande Valley and parts of Central Texas. The … |
| krne.com | · Oct 10, 2025 | Krne Law Firm a small to mid-size private legal practice, perhaps specializing in general civil law, real estate, business contracts, … |
| glatten.de | · Oct 10, 2025 | Located in Glatten, J. Schmalz GmbH is a long-established, family-run engineering group specialising in vacuum technology and automation for handling … |
| portofuneralhomes.net | · Oct 10, 2025 | Porto Funeral Homes (Porto / Porto Funeral Home) operates funeral and memorial services in New Haven County, Connecticut, with facilities … |
| ggw.net | · Oct 10, 2025 | Glenn Graydon Wright LLP (GGW) is an established Oakville, Ontario accounting and advisory firm (founded 1958) that provides assurance, tax, … |
| cmlmachinery.com | · Oct 10, 2025 | CML Machinery is a Canadian distributor and supplier of metal-forming and woodworking equipment — press brakes, shears, tube benders, CNC … |
| biosorthopedics.com | · Sep 17, 2025 | Broward Institute of Orthopaedic Specialties (BIOS) is a multi-physician orthopaedic practice headquartered in Hollywood and Pembroke Pines, Florida. The practice … |
| gosheating.co.uk | · Sep 17, 2025 | GOS Heating is a long-standing, family-run heating, plumbing and electrical contractor based in Preston, Lancashire. The company markets domestic and … |
| browneco.com | · Sep 17, 2025 | Browne (Browne Group Inc.) is a legacy kitchenware and foodservice products designer and distributor with a multi-decade history (70+ years) … |
| alliancesteelco.com | · Sep 17, 2025 | “Alliance Steel” is a generic trade name used by multiple flat-rolled steel service centers in North America; relevant examples include … |
| slusarski.com | · Sep 17, 2025 | Slusarski is a Michigan-based sitework, earthmoving and paving contractor founded in 1982 that provides excavation, asphalt paving, sealcoating, striping, materials … |
| drcloudemr.com | · Sep 17, 2025 | DrCloudEHR (often referenced as DrCloud/DrCloudEMR) provides cloud-hosted electronic health record (EHR) / practice management software targeted at ambulatory clinics and … |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .