safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
Victims · 7d
10flat
Victims · 30d
22active targets
Victims · 90d
67
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
Tactics & tooling
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
Estimated earnings
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| venetianassociates.com | · Sep 17, 2025 | Venetian Associates is a private family-office style investment vehicle and lower-middle-market acquirer based in Michigan that focuses on buying consumer … |
| armourhome.co.uk | · Sep 17, 2025 | Armour Home is a UK-based designer, manufacturer and distributor of hi-fi, home-cinema and multi-room audio furniture and electronic solutions. The … |
| cityofmiddletown.org | · Sep 12, 2025 | The City of Middletown, located in Ohio, United States, operates as a municipal government dedicated to providing essential services and … |
| osdcourtks.org | · Sep 12, 2025 | The domain osdcourtks.org appears to belong to the Osage County District Court in Kansas. As part of Kansas’s Fourth Judicial … |
| halbarstainless.com | · Sep 12, 2025 | Halbar Stainless Products Ltd., founded in 1974 by Cliff Baird, is a family-owned custom metal fabrication company specializing in stainless … |
| waverlychildcare.org | · Sep 10, 2025 | Waverly Child Care & Preschool is a nonprofit early childhood education provider based in Waverly, Iowa, established in 1970. It … |
| bthcpa.com | · Sep 1, 2025 | BTH CPA is a professional accounting and advisory firm based in the United States, offering a full range of financial … |
| umweltprofis.at | · Sep 1, 2025 | Umweltprofis is an Austrian company specializing in environmental management, waste disposal, and recycling solutions. It provides sustainable services for municipalities, … |
| waterfordsurgicalcenter.com | · Sep 1, 2025 | Waterford Surgical Center is a specialized healthcare facility in the United States dedicated to outpatient surgical care. The center provides … |
| oiwky.com | · Sep 1, 2025 | Oiwky is a U.S.-based technology and innovation company focused on providing IT solutions, digital platforms, and business support services. The … |
| kclub.ie | · Sep 1, 2025 | The K Club is a luxury resort and golf destination located in County Kildare, Ireland. Known for its five-star accommodations, … |
| usai.io | · Sep 1, 2025 | USAI is a U.S.-based artificial intelligence and technology solutions provider. The company develops AI-driven platforms and software designed to optimize … |
| wilsonatllaw.com | · Sep 1, 2025 | Wilson AT Law is a U.S.-based legal practice specializing in areas such as personal injury, family law, estate planning, and … |
| scottschiff.com | · Sep 1, 2025 | Scott Schiff & Associates is a U.S.-based law firm located in Columbus, Ohio, with a specialization in personal injury and … |
| mdneal.com | · Sep 1, 2025 | M.D. Neal Engineering is an American engineering consulting company specializing in structural engineering, design, and project management. The firm provides … |
| sandersonmanagement.com | · Aug 30, 2025 | Sanderson Management is a renowned property management company based in the United States, specializing in the efficient and effective management … |
| lipcare.de | · Aug 29, 2025 | Lipcare, operated by KHK GmbH in Germany, is a specialized manufacturer of natural and conventional cosmetics, with a particular focus … |
| companionsandhomemakers.com | · Aug 29, 2025 | Companions & Homemakers, based in Connecticut, is a nonprofit home-care service provider with more than 30 years of experience. It … |
| camaravalencia.com | · Aug 29, 2025 | The Cámara de Valencia, officially known as the Chamber of Commerce, Industry, Services and Navigation of Valencia, was founded in … |
| dasmeshschool.com | · Aug 29, 2025 | Dasmesh Punjabi School in Winnipeg, Manitoba, is a private independent institution that integrates the provincial curriculum with Punjabi language, Sikh … |
| zanettisrl.it | · Aug 29, 2025 | Zanetti S.r.l., headquartered in Florence, Italy, is a leading architectural company specializing in the design and construction of glass and … |
| uwock.ca | · Aug 29, 2025 | Information Chatham-Kent is a nonprofit service based in Ontario, Canada, and operated under United Way Chatham-Kent. It serves as a … |
| hardwicktactical.com | · Aug 29, 2025 | Hardwick Tactical Corporation, located in Cleveland, Tennessee, is a historic American manufacturer of military and professional uniforms. Founded in 1880, … |
| templeemanu-el.org | · Aug 29, 2025 | Temple Emanu-El, located in Dallas, Texas, is one of the largest and most historically significant Reform Jewish congregations in the … |
| thecelestehotel.com | · Aug 29, 2025 | The Celeste Hotel is a boutique hotel located in Orlando, Florida, within the University of Central Florida (UCF) campus area. … |
| decor-metall.de | · Aug 28, 2025 | Founded in 1963 and based in Bad Salzuflen, Germany, decor metall GmbH is a globally recognized specialist in point-of-sale (POS) … |
| akd-ekbo.de | · Aug 26, 2025 | The Amt für kirchliche Dienste (AKD) is the central continuing education institution for professional and volunteer staff of the Evangelical … |
| jphrs-waghaeusel.de | · Aug 26, 2025 | Johann-Peter-Hebel Realschule, located in Waghäusel, Baden-Württemberg, is a German secondary school offering intermediate-level education for students aged approximately 10 to … |
| parksidegroup.co.uk | · Aug 26, 2025 | Parkside Group Ltd is a respected UK-based manufacturer and distributor of architectural-grade aluminium systems, operating under its prominent Comar brand. … |
| ferienwohnungen.de | · Aug 26, 2025 | Ferienwohnungen.de is a German online booking platform that connects travelers to over 77,000 holiday homes and apartments across Europe. Operated … |
| phillips66lubricants.com | · Aug 26, 2025 | hillips 66 Lubricants is a leading U.S.-based manufacturer and supplier of industrial and automotive lubricants. As part of the larger … |
| faltner.de | · Aug 26, 2025 | Faltner GmbH, established in 1946, is a German provider based in Büchlberg that specializes in agricultural and forestry equipment, as … |
| optivosa.com | · Aug 26, 2025 | Optivosa is a wholesale distributor located in Mérida, Yucatán, that provides a wide array of products for stationery stores, offices, … |
| rivertoncabinets.com | · Aug 26, 2025 | Riverton Cabinet Company is a U.S.-based custom cabinetry firm in New Lenox, Illinois, known for its craftsmanship and personalized design … |
| schliessmeyer.de | · Aug 26, 2025 | SCHLIESSMEYER GmbH, part of the Ernst Plastics Group and based in Zweibrücken, Germany, specializes in plastic injection molding. The company … |
| childrenscouncil.org | · Aug 19, 2025 | Children’s Council of San Francisco is a nonprofit organization with over 50 years of experience advocating for and facilitating high-quality … |
| albertaindustrialcontrols.com | · Aug 15, 2025 | Alberta Industrial Controls & Drives Inc., based in Edmonton, Alberta, is a reputable distributor of industrial electronic controls and motors … |
| listgrove.com | · Aug 15, 2025 | Listgrove Limited is a specialist recruitment and HR consultancy headquartered in Stratford-upon-Avon, England. Founded in 1975, the firm focuses on … |
| transelectric.co.il | · Aug 15, 2025 | TransElectric, part of the Israeli Trans Innovation Group (TIG), is a value-add distributor of electronic components and electro-mechanical solutions. Based … |
| batemangroundworks.co.uk | · Aug 15, 2025 | Bateman Groundworks Ltd, headquartered in Norwich, East Anglia, is a leading civil engineering and groundworks contractor. Active since 1997, Bateman … |
| godbyhearth.com | · Aug 15, 2025 | Operating in Indianapolis and Carmel, Indiana, Godby Hearth & Home is a premium provider of home comfort solutions with origins … |
| New blog, click to go | · Aug 11, 2025 | — |
| mauilodging.com | · Aug 9, 2025 | — |
| ridgefield.org | · Aug 5, 2025 | — |
| chamberlainhuckeriede.com | · Aug 1, 2025 | — |
| ingrammicro.com | · Jul 29, 2025 | — |
| bussepc.com | · Jul 26, 2025 | — |
| swfldermatology.com | · Jul 26, 2025 | — |
| havtechpa.com | · Jul 26, 2025 | — |
| appagroup.com | · Jul 26, 2025 | — |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .