Ransomware Group intelligence

Safepay

Active

Track Safepay with 570 published victims and 5 known leak locations in a single intelligence view.

Victims 570 Known published victims in this dataset
First discovered 2024-11-19 Earliest victim discovery date
Last discovered 2026-07-27 Latest victim discovery date
Inactive since 1 days Days since the latest known victim
Top country United States 212 victims
Known locations 5 Leak or negotiation infrastructure tracked

Overview

Safepay is tracked by Breach House as a ransomware group with 570 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (5)

    Label Type Availability Links
    Leak location 1 Onion service Unknown nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion
    Leak location 2 Onion service Unknown cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion
    Leak location 3 Onion service Unknown nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion
    Leak location 4 Onion service Unknown j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion
    Leak location 5 Onion service Unknown safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion

    Top Activity Sectors

    No sector intelligence available.

    Research Sources

    No external research sources linked yet.

    Victims (570)

    Search, filter and paginate the victim timeline for Safepay. Showing 1–100 of 570.

    Type Target Discovered Country Business Category Intel Link
    Ransomware zinorm.de id30991 View details Germany IT
    Ransomware zinorm.de id30991 View details Germany IT
    Ransomware moebelmayer.de id30992 View details Germany Retail / E-commerce
    Ransomware moebelmayer.de id30992 View details Germany Retail / E-commerce
    Ransomware paritaet-nrw.org id30993 View details Germany NGOs / Associations
    Ransomware paritaet-nrw.org id30993 View details Germany NGOs / Associations
    Ransomware haugbuersten.de id30994 View details Germany Manufacturing / Engineering
    Ransomware haugbuersten.de id30994 View details Germany Manufacturing / Engineering
    Ransomware landesmuseum.de id30995 View details Germany Public Sector
    Ransomware landesmuseum.de id30995 View details Germany Public Sector
    Ransomware hst.eu id30996 View details Germany
    Ransomware braywoodschool.co.uk id30997 View details United Kingdom
    Ransomware weier.org id30985 View details Germany Other
    Ransomware weier.org id30985 View details Germany Other
    Ransomware bnpdist.com id30986 View details United States Finance / Legal / Insurance
    Ransomware bnpdist.com id30986 View details United States Finance / Legal / Insurance
    Ransomware upland.k12.ca.us id30831 View details United States Education
    Ransomware upland.k12.ca.us id30831 View details United States Education
    Ransomware gvsurgicalarts.com id30832 View details United States Healthcare / Medicine
    Ransomware gvsurgicalarts.com id30832 View details United States Healthcare / Medicine
    Ransomware wdk.de id30710 View details Germany Finance / Legal / Insurance
    Ransomware wdk.de id30710 View details Germany Finance / Legal / Insurance
    Ransomware jaecklin-industrial.de id30711 View details Germany Manufacturing / Engineering
    Ransomware jaecklin-industrial.de id30711 View details Germany Manufacturing / Engineering
    Ransomware lbb-treuhand.de id30712 View details Germany Finance / Legal / Insurance
    Ransomware lbb-treuhand.de id30712 View details Germany Finance / Legal / Insurance
    Ransomware timetex.de id30713 View details Germany Manufacturing / Engineering
    Ransomware timetex.de id30713 View details Germany Manufacturing / Engineering
    Ransomware stroebel-gruppe.de id30714 View details Germany Manufacturing / Engineering
    Ransomware stroebel-gruppe.de id30714 View details Germany Manufacturing / Engineering
    Ransomware industriesjaro.com id30715 View details Canada Manufacturing / Engineering
    Ransomware industriesjaro.com id30715 View details Canada Manufacturing / Engineering
    Ransomware cenesco.de id30716 View details Germany IT
    Ransomware cenesco.de id30716 View details Germany IT
    Ransomware acsmallmaxwell.com.au id30717 View details Australia Finance / Legal / Insurance
    Ransomware acsmallmaxwell.com.au id30717 View details Australia Finance / Legal / Insurance
    Ransomware mende-grundbesitz.de id30718 View details Germany Construction / Real Estate
    Ransomware mende-grundbesitz.de id30718 View details Germany Construction / Real Estate
    Ransomware shuttlemeadowcc.com id30525 View details United States Transportation / Travel / Logistics
    Ransomware shuttlemeadowcc.com id30525 View details United States Transportation / Travel / Logistics
    Ransomware matrixwebagency.com id30296 View details United States Communication / Marketing
    Ransomware matrixwebagency.com id30296 View details United States Communication / Marketing
    Ransomware bmiprojects.de id30297 View details Germany Construction / Real Estate
    Ransomware bmiprojects.de id30297 View details Germany Construction / Real Estate
    Ransomware caritas-koblenz.de id30298 View details Germany NGOs / Associations
    Ransomware caritas-koblenz.de id30298 View details Germany NGOs / Associations
    Ransomware knobel-bau.de id30299 View details Germany Construction / Real Estate
    Ransomware knobel-bau.de id30299 View details Germany Construction / Real Estate
    Ransomware rtngmbh.de id30300 View details Germany IT
    Ransomware rtngmbh.de id30300 View details Germany IT
    Ransomware stedwardscatholicfirstschool.co.uk id30301 View details United Kingdom Education
    Ransomware stedwardscatholicfirstschool.co.uk id30301 View details United Kingdom Education
    Ransomware lh-wohnverbund-wohnen-nrw.de id30302 View details Germany Construction / Real Estate
    Ransomware lh-wohnverbund-wohnen-nrw.de id30302 View details Germany Construction / Real Estate
    Ransomware shw-fr.de id30303 View details Germany Manufacturing / Engineering
    Ransomware shw-fr.de id30303 View details Germany Manufacturing / Engineering
    Ransomware hahn-airport.de id30295 View details Germany Transportation / Travel / Logistics
    Ransomware hahn-airport.de id30295 View details Germany Transportation / Travel / Logistics
    Ransomware awo-suedost.de id30165 View details Germany NGOs / Associations
    Ransomware awo-suedost.de id30165 View details Germany NGOs / Associations
    Ransomware dia179.com id30166 View details Germany Other
    Ransomware dia179.com id30166 View details Germany Other
    Ransomware eaglecrestlife.org id30167 View details United States NGOs / Associations
    Ransomware eaglecrestlife.org id30167 View details United States NGOs / Associations
    Ransomware hellmold-plank.de id30048 View details Germany Manufacturing / Engineering
    Ransomware hellmold-plank.de id30048 View details Germany Manufacturing / Engineering
    Ransomware ehg.bayern id30090 View details Germany Other
    Ransomware seinordovest.it id29951 View details Italy Services
    Ransomware harcourts.net id29952 View details Australia Construction / Real Estate
    Ransomware zaunsysteme.de id29953 View details Germany Manufacturing / Engineering
    Ransomware brscappuccio.it id29954 View details Italy Hospitality / Food & Beverage / Tourism
    Ransomware gut-heckenhof.de id29955 View details Germany Agriculture / Food
    Ransomware hughstirling.co.uk id29899 View details Germany Construction / Real Estate
    Ransomware tokyocivil.co.jp id29900 View details Japan Construction / Real Estate
    Ransomware kawaius.com id29901 View details United States IT
    Ransomware musenet.co.jp id29902 View details Japan IT
    Ransomware bautz-maschinenbau.de id29903 View details Germany Manufacturing / Engineering
    Ransomware aquaclean.com id29904 View details Spain Healthcare / Medicine
    Ransomware hoodriversheriff.com id29905 View details United States Public Sector
    Ransomware iql-nog.com id29571 View details Spain Other
    Ransomware tavolaspa.com id29548 View details Italy Hospitality / Food & Beverage / Tourism
    Ransomware parsa-beauty.de id29549 View details Germany Retail / E-commerce
    Ransomware soraris.it id29550 View details Italy IT
    Ransomware lcnet.eu id29551 View details Germany IT
    Ransomware verzolla.com id29552 View details Italy Other
    Ransomware compactmould.com id29553 View details Canada Manufacturing / Engineering
    Ransomware eitecpro.co.jp id29514 View details Japan Other
    Ransomware tme-rusta.de id29515 View details Germany Manufacturing / Engineering
    Ransomware cyuou.com id29516 View details Japan Communication / Marketing
    Ransomware vdmtrucking.com id29517 View details Canada Other
    Ransomware olipes.com id29276 View details Spain Manufacturing / Engineering
    Ransomware harrisoncountywv.com id29229 View details United States Other
    Ransomware printroom.co.uk id29230 View details United Kingdom Other
    Ransomware hautarzt-budihardja.de id29231 View details Germany Healthcare / Pharma
    Ransomware mediafrance.de id29232 View details Germany Other
    Ransomware ashleytimber.co.uk id29233 View details United Kingdom Other
    Ransomware adlan.com id29234 View details Canada IT
    Ransomware Berlinmobil.de id29226 View details Germany Education
    Ransomware smp.cat id28918 View details Spain Healthcare / Medicine
    Ransomware gingerichtrucking.com id28919 View details United States Transportation / Travel / Logistics