safepay
ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07
SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.
- Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
- Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
- SQL-injection-based access described in 2021 vendor research
- Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
- Per-victim negotiation rather than standardized public ransom demands
- Targets predominantly small and mid-sized businesses with no single sector focus
- Maintains a low public profile with limited dedicated malware analysis
Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)
No public figure.
Leak-site victims573 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| briar-group.com | · Jul 26, 2025 | — |
| teamsignal.com | · Jul 26, 2025 | — |
| tele-optics.com | · Jul 26, 2025 | — |
| appsnw.com | · Jul 26, 2025 | — |
| wta-inc.com | · Jul 26, 2025 | — |
| blueridgesl.com | · Jul 22, 2025 | — |
| rhschool.org | · Jul 22, 2025 | — |
| qtmi.net | · Jul 22, 2025 | — |
| horanbarker.com | · Jul 22, 2025 | — |
| naxis.net | · Jul 22, 2025 | — |
| landwwilson.co.uk | · Jul 22, 2025 | — |
| salemma.com.py | · Jul 22, 2025 | — |
| stichtingjohannesbosco.com | · Jul 22, 2025 | — |
| bisa.com.pe | · Jul 22, 2025 | — |
| norpak.com | · Jul 18, 2025 | — |
| ashland.k12.ma.us | · Jul 17, 2025 | — |
| divgroup.eu | · Jul 17, 2025 | — |
| hlb.ie | · Jul 17, 2025 | — |
| palmasdelixcan.com | · Jul 17, 2025 | — |
| accademia.it | · Jul 17, 2025 | — |
| nod.ro | · Jul 12, 2025 | — |
| bartec.com | · Jul 12, 2025 | — |
| silverdalebc.com | · Jul 7, 2025 | — |
| chirurgiemaxillo.com | · Jul 7, 2025 | — |
| lowcostspayneuterindiana.org | · Jul 7, 2025 | — |
| avgouleaschool.gr | · Jul 7, 2025 | — |
| lewis-manning.org.uk | · Jul 7, 2025 | — |
| wmat.nsn.us | · Jul 7, 2025 | — |
| cascobay.org | · Jul 7, 2025 | — |
| profile-ind.com | · Jul 7, 2025 | — |
| relucent.com | · Jul 7, 2025 | — |
| fmsarchitects.com | · Jul 7, 2025 | — |
| ppa-eng.com.org | · Jul 7, 2025 | — |
| caredig.co.uk | · Jul 7, 2025 | — |
| dossenterprises.com | · Jul 1, 2025 | — |
| lafayettefamilyymca.org | · Jul 1, 2025 | — |
| jansen-aschendorf.de | · Jul 1, 2025 | — |
| tdunhamcpa.com | · Jun 25, 2025 | — |
| mccn.org | · Jun 23, 2025 | — |
| mlderm.com | · Jun 23, 2025 | — |
| membersourcecu.org | · Jun 17, 2025 | — |
| macedonia.oh.us | · Jun 17, 2025 | — |
| codesco.com | · Jun 14, 2025 | — |
| packagesteel.com | · Jun 14, 2025 | — |
| hohmannoilandplumbing.com | · Jun 14, 2025 | — |
| cs-groupllc.com | · Jun 14, 2025 | — |
| pzsarchitects.com | · Jun 14, 2025 | — |
| welcometosedgebrook.com | · Jun 14, 2025 | — |
| moffett-towers-club.com | · Jun 14, 2025 | — |
| liberty-township.com | · Jun 14, 2025 | — |
In the newsAll →
No articles mention this group yet.