Ransomware Group intelligence

Safepay

Active

Track Safepay with 616 published victims and 5 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 616 Known published victims in this dataset

First discovered 2024-11-19 Earliest victim discovery date

Last discovered 2026-09-11 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 226 victims

Known locations 5 Leak or negotiation infrastructure tracked

Safepay is tracked by Breach House as a ransomware group with 616 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

140

Leaked 0 0.0%
Pending 139 99.3%
Deleted 1 0.7%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 5	Onion service	Up checked 4h ago	`safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion`
Leak location 4	Onion service	Down checked 4h ago	`j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion`
Leak location 3	Onion service	Down checked 4h ago	`nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion`
Leak location 2	Onion service	Down checked 4h ago	`cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion`
Leak location 1	Onion service	Down checked 4h ago	`nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion`

Not identified 144
Communication / Marketing 93
Manufacturing / Engineering 54
Services 38
Construction / Real Estate 31
IT 30
Healthcare / Pharma 28
Finance / Legal / Insurance 27
Education 25
Retail / E-commerce 22
Agriculture / Food 15
Transportation / Travel / Logistics 14
Public Sector 13
Hospitality / Food & Beverage / Tourism 12
NGOs / Associations 9
Energy 4

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1688 Safe Mode Boot Defense Impairment

What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.

What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
T1027.016 Junk Code Insertion Stealth

What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.

What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
T1070.004 File Deletion Stealth

What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1135 Network Share Discovery Discovery

What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1491.001 Internal Defacement Impact

What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Tools Observed (8)

▼

Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery

Invoke-ShareFinder

Exfiltration

FileZilla 7zip WinRAR

LOLBAS (living-off-the-land binaries)

Regsvr32.exe CMSTPLUA dllhost.exe

RMM Tools

Microsoft RDP

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (2)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

readme_safepay.txt txt · 3019 chars

Greetings! Your corporate network was attacked by SafePay team.

Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.

It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.

We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.

Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.

Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.

We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM.

In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.

In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

Install and run Tor Browser from https://www.torproject.org/download/

Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion

Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion

Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

Our blog:

http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion

http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

Our TON blog:

tonsite://safepay.ton

You can connect through your Telegramm account.

View on RansomLook

readme_safepay_ascii.txt txt · 2999 chars

Greetings! Your corporate network was attacked by SafePay team.
Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.
It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.
We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.
Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.
Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.
We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM.
In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.
In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

Install and run Tor Browser from https://www.torproject.org/download/

Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion

Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion

Log in with ID: [snip]
Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

Our blog:

http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion

http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

Our TON blog:
tonsite://safepay.ton

You can connect through your Telegramm account.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (616)

Search, filter and paginate the victim timeline for Safepay. Showing 101–200 of 616.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	shw-fr.de id30303 View details	2026-07-06	Germany	Manufacturing / Engineering	pending
shw-fr.de is a company based in Germany, operating in the manufacturing and engineering sector. The company likely provides various services and products related to its sector. shw-fr.de was listed as a ransomware victim associated with safepay ID 30303
Ransomware	shw-fr.de id30303 View details	2026-07-06	Germany	Manufacturing / Engineering	pending
The company traces its origins to 1596, making it one of Germany's oldest industrial manufacturers, although its current corporate structure … ID 30303
Ransomware	hahn-airport.de id30295 View details	2026-07-06	Germany	Transportation / Travel / Logistics	pending
Hahn Airport, located in Germany, is a key player in the country's transportation and travel logistics sector, offering a range of services including cargo handling and passenger flights. As a major airport, it plays a significant role in facilitating travel and trade in the region. Hahn Airport was listed as a ransomware victim associated with safepay. ID 30295
Ransomware	hahn-airport.de id30295 View details	2026-07-06	Germany	Transportation / Travel / Logistics	pending
Originally developed as a United States military air base, the facility began civilian operations in 1993 and has since become … ID 30295
Ransomware	awo-suedost.de id30165 View details	2026-07-01	Germany	NGOs / Associations	pending
Awo-suedost.de is a German non-governmental organization operating in the southeastern region of Germany, providing social services and support to local communities. As an association, it offers various programs and initiatives to promote social welfare and community development. Awo-suedost.de was listed as a ransomware victim associated with safepay ID 30165
Ransomware	awo-suedost.de id30165 View details	2026-07-01	Germany	NGOs / Associations	pending
Established in 1994, it is one of the regional branches of the Arbeiterwohlfahrt (AWO), one of Germany's six largest independent … ID 30165
Ransomware	dia179.com id30166 View details	2026-07-01	Germany	Other	pending
Dia179.com is a German entity operating in the other sector. The company is based in Germany and provides various offerings. Dia179.com was listed as a ransomware victim associated with safepay ID 30166
Ransomware	dia179.com id30166 View details	2026-07-01	Germany	Other	pending
Founded in 2007, the firm specializes in industrial architecture, logistics facilities, research centers, production plants, and corporate office buildings. Unlike … ID 30166
Ransomware	eaglecrestlife.org id30167 View details	2026-07-01	United States	NGOs / Associations	pending
Eaglecrestlife.org is a non-governmental organization based in the United States, operating in the sector of NGOs and associations. The organization likely provides various services and support to its community. Eaglecrestlife.org was listed as a ransomware victim associated with safepay. ID 30167
Ransomware	eaglecrestlife.org id30167 View details	2026-07-01	United States	NGOs / Associations	pending
Operating under Bethany Lutheran Homes, Inc., the organization has served the region since 1946 and is recognized as the largest … ID 30167
Ransomware	hellmold-plank.de id30048 View details	2026-06-27	Germany	Manufacturing / Engineering	pending
Hellmold-plank.de operates in the manufacturing and engineering sector, providing services in Germany. The company's specific offerings are not publicly disclosed, but it is known to be part of the country's industrial landscape. Hellmold-plank.de was listed as a ransomware victim associated with safepay ID 30048
Ransomware	hellmold-plank.de id30048 View details	2026-06-27	Germany	Manufacturing / Engineering	pending
Founded in 1904 by Heinrich Hellmold and Heinrich Plank, the company has evolved from a local cartage business into a … ID 30048
Ransomware	ehg.bayern id30090 View details	2026-06-22	Germany	Other	pending
Founded in 1991, the company has evolved from a regional waste management enterprise into a specialized provider of infrastructure operations, … ID 30090
Ransomware	seinordovest.it id29951 View details	2026-06-17	Italy	Services	pending
Headquartered in the Piedmont region, the company operates as a public utility serving numerous municipalities in northwestern Italy. Its mission … ID 29951
Ransomware	harcourts.net id29952 View details	2026-06-17	Australia	Construction / Real Estate	pending
Founded in 1888 in Wellington, New Zealand, the company has grown from a local real estate agency into a global … ID 29952
Ransomware	zaunsysteme.de id29953 View details	2026-06-17	Germany	Manufacturing / Engineering	pending
Operating within Germany’s construction materials and perimeter security sector, the company provides a wide range of products, including double-wire mesh … ID 29953
Ransomware	brscappuccio.it id29954 View details	2026-06-17	Italy	Hospitality / Food & Beverage / Tourism	pending
Headquartered in Casandrino, near Naples in the Campania region, the company specializes in the distribution and supply of medical devices, … ID 29954
Ransomware	gut-heckenhof.de id29955 View details	2026-06-17	Germany	Agriculture / Food	pending
Established in 1992, the company operates a four-star hotel and one of the largest golf facilities in the region. The … ID 29955
Ransomware	hughstirling.co.uk id29899 View details	2026-06-15	Germany	Construction / Real Estate	pending
Headquartered in Goslar, Lower Saxony, the firm has been operating since 1975 and has expanded its presence through additional offices … ID 29899
Ransomware	tokyocivil.co.jp id29900 View details	2026-06-15	Japan	Construction / Real Estate	pending
Established in 2020, the company specializes in public infrastructure and civil engineering projects, serving primarily the Tokyo metropolitan area and … ID 29900
Ransomware	kawaius.com id29901 View details	2026-06-15	United States	IT	pending
Founded in Japan in 1927 by Koichi Kawai, the company has established a reputation for combining traditional Japanese craftsmanship with … ID 29901
Ransomware	musenet.co.jp id29902 View details	2026-06-15	Japan	IT	pending
Founded in the twentieth century, the company serves as an intermediary between publishers and music retailers throughout Japan. Its online … ID 29902
Ransomware	bautz-maschinenbau.de id29903 View details	2026-06-15	Germany	Manufacturing / Engineering	pending
Founded in 1960 by Alfred Bautz, the family-owned enterprise has developed over three generations into a specialized supplier of precision … ID 29903
Ransomware	aquaclean.com id29904 View details	2026-06-15	Spain	Healthcare / Pharma	pending
The company operates as part of Interfabrics S.L. and has more than 50 years of experience in the textile industry. … ID 29904
Ransomware	hoodriversheriff.com id29905 View details	2026-06-15	United States	Public Sector	pending
Headquartered in Hood River, the organization provides a broad range of services, including patrol operations, criminal investigations, emergency communications, search … ID 29905
Ransomware	iql-nog.com id29571 View details	2026-06-02	Spain	Other	pending
Founded in 1947, the company specializes in the production of oleochemical products, particularly fatty acid esters and specialty chemicals derived … ID 29571
Ransomware	tavolaspa.com id29548 View details	2026-06-01	Italy	Hospitality / Food & Beverage / Tourism	—
Over more than seventy years of operation, the company has evolved from an import-export business into a diversified manufacturer, distributor, … ID 29548
Ransomware	parsa-beauty.de id29549 View details	2026-06-01	Germany	Retail / E-commerce	—
Founded in 1986, the company has become one of Europe’s leading manufacturers and distributors of hair, beauty, and personal care … ID 29549
Ransomware	soraris.it id29550 View details	2026-06-01	Italy	IT	—
Founded in 1983, the company specializes in the collection, transportation, treatment, and management of municipal solid waste and recyclable materials. … ID 29550
Ransomware	lcnet.eu id29551 View details	2026-06-01	Germany	IT	—
The network was established to provide integrated cross-border transport solutions, allowing member companies to coordinate freight movements efficiently throughout Europe. … ID 29551
Ransomware	verzolla.com id29552 View details	2026-06-01	Italy	Other	—
Founded in 1958 (with the current corporate structure established in 2007), the company specializes in supplying industrial components, automation systems, … ID 29552
Ransomware	compactmould.com id29553 View details	2026-06-01	Canada	Manufacturing / Engineering	pending
Founded in 1978 and headquartered in Woodbridge, Ontario, the company has grown into one of North America’s major suppliers of … ID 29553
Ransomware	eitecpro.co.jp id29514 View details	2026-05-25	Japan	Other	—
Founded in 1988 and headquartered in Osaka, the company operates multiple regional offices across Japan, including Tokyo, Yokohama, Nagoya, Sendai, … ID 29514
Ransomware	tme-rusta.de id29515 View details	2026-05-25	Germany	Manufacturing / Engineering	—
The company was originally founded in Munich in 1966 as an artistic metalworking workshop and later expanded into woodworking, plastics … ID 29515
Ransomware	cyuou.com id29516 View details	2026-05-25	Japan	Communication / Marketing	—
Founded in 2000, the company specializes in website development, digital advertising, graphic design, Wi-Fi infrastructure projects, and online business support … ID 29516
Ransomware	vdmtrucking.com id29517 View details	2026-05-25	Canada	Other	—
Headquartered in Edmonton, Alberta, the company has operated for more than 40 years and has developed into a significant regional … ID 29517
Ransomware	olipes.com id29276 View details	2026-05-19	Spain	Manufacturing / Engineering	—
Founded in 1993 and headquartered in Campo Real, Madrid, the company has become an important independent manufacturer in the European … ID 29276
Ransomware	harrisoncountywv.com id29229 View details	2026-05-18	United States	Other	pending
The Commission functions as the executive administrative body for the county and is responsible for overseeing public infrastructure, fiscal management, … ID 29229
Ransomware	printroom.co.uk id29230 View details	2026-05-18	United Kingdom	Other	—
Founded in 1977, the company has evolved from a small blueprint-printing business into a large multi-service print agency serving corporate, … ID 29230
Ransomware	hautarzt-budihardja.de id29231 View details	2026-05-18	Germany	Healthcare / Pharma	—
The clinic is led by Dr. med. Debby Budihardja, a board-certified dermatologist and allergologist with extensive clinical experience gained at … ID 29231
Ransomware	mediafrance.de id29232 View details	2026-05-18	Germany	Other	—
The company operates primarily in France while maintaining media-related partnerships and activities across European markets, including Germany. Its business model … ID 29232
Ransomware	ashleytimber.co.uk id29233 View details	2026-05-18	United Kingdom	Other	pending
Founded in 1988, the company operates as a family-run SME and has developed a strong regional presence in the North … ID 29233
Ransomware	adlan.com id29234 View details	2026-05-18	Canada	IT	pending
Founded in 1995, the company specializes in IT infrastructure, network design, cybersecurity, disaster recovery, and managed technology services for small … ID 29234
Ransomware	Berlinmobil.de id29226 View details	2026-05-18	Germany	Education	—
Is a German transportation company headquartered in Berlin, specializing in bus charter services, passenger transportation, school transport, and mobility solutions … ID 29226
Ransomware	smp.cat id28918 View details	2026-05-06	Spain	Healthcare / Pharma	—
Is a private healthcare organization based in Catalonia, Spain, operating in the Hospitals & Physicians Clinics sector. Founded in 1993 … ID 28918
Ransomware	gingerichtrucking.com id28919 View details	2026-05-06	United States	Transportation / Travel / Logistics	pending
Is a U.S.-based freight transportation company operating primarily in interstate logistics. The company specializes in hauling general freight, agricultural products … ID 28919
Ransomware	jmige.com id28920 View details	2026-05-06	United States	Communication / Marketing	pending
JMIGE appears to be a company with limited publicly available information, making precise classification difficult. Based on naming conventions and … ID 28920
Ransomware	id-s.de id28923 View details	2026-05-06	Germany	IT	pending
Is a German company operating in the field of digital technologies and IT-related services. Although detailed public information is limited, … ID 28923
Ransomware	mbk-gmbh.de id28924 View details	2026-05-06	Germany	Manufacturing / Engineering	pending
Is a German industrial company specializing in metal processing and surface finishing technologies. The company provides services such as galvanizing, … ID 28924
Ransomware	ettp.be id28925 View details	2026-05-06	Belgium	Transportation / Travel / Logistics	pending
Appears to be a Belgian-based entity likely involved in professional training, technology consulting, or industrial services. While detailed public data … ID 28925
Ransomware	studioubertazzi.it id28926 View details	2026-05-06	Italy	Finance / Legal / Insurance	—
Is an Italian firm that likely operates in the field of professional services such as architecture, design, or engineering consulting. … ID 28926
Ransomware	globalmerchservices.com id28927 View details	2026-05-06	United Kingdom	Retail / E-commerce	pending
Global Merchandising Services (GMS) is an international entertainment merchandising company founded in 2008. It specializes in developing and managing merchandise … ID 28927
Ransomware	soavegel.it id28928 View details	2026-05-06	Italy	Agriculture / Food	—
Is an Italian food manufacturing company specializing in frozen gastronomic products. Founded in 1935 in Francavilla Fontana, the company has … ID 28928
Ransomware	hokuyo2006.co.jp id28867 View details	2026-05-04	Japan	Construction / Real Estate	pending
Is a Japanese company that operates as part of a larger industrial group connected to packaging, logistics, and housing-related businesses. … ID 28867
Ransomware	bootstransport.ca id28868 View details	2026-05-04	Canada	Transportation / Travel / Logistics	—
Is a Canadian transportation and logistics company specializing in freight delivery and supply chain services. The company primarily operates in … ID 28868
Ransomware	dahlgrenscement.se id28869 View details	2026-05-04	Sweden	Construction / Real Estate	—
Is a Swedish company operating in the construction materials sector, particularly focused on cement and related building products. Companies in … ID 28869
Ransomware	maiadouro.pt id28870 View details	2026-05-04	Portugal	Manufacturing / Engineering	—
Appears to be a Portuguese company connected to the Douro region, which is internationally known for wine production and agriculture. … ID 28870
Ransomware	zonaovest.to.it id28871 View details	2026-05-04	Italy	Public Sector	—
Is likely an Italian regional organization or consortium based in the Turin (Torino) area. Entities with similar naming conventions in … ID 28871
Ransomware	fital-treppenlifte.de id28872 View details	2026-05-04	Germany	Healthcare / Pharma	pending
Is a German company specializing in stairlifts and mobility solutions for individuals with reduced mobility. The company operates in the … ID 28872
Ransomware	energyaction.com.au id28333 View details	2026-05-01	Australia	Energy	—
Is an energy management and consulting company that helps businesses reduce their energy costs and carbon emissions. Its main services … ID 28333
Ransomware	hpk.hamburg id28334 View details	2026-05-01	Germany	Finance / Legal / Insurance	pending
Is a Hamburg-based, family-run international trading company with over 50 years of experience, specializing in premium meat and seafood imports. … ID 28334
Ransomware	bbalawgroup.com id28275 View details	2026-04-17	United States	Finance / Legal / Insurance	—
Also referred to as BBA Immigration, is a boutique U.S. legal practice headquartered in Houston, Texas, specialising in immigration law … ID 28275
Ransomware	firstcambodia.com.kh id28274 View details	2026-04-17	Cambodia	IT	—
First Cambodia Co., Ltd. is a leading IT services and system integration company headquartered in Phnom Penh, Cambodia. Founded in … ID 28274
Ransomware	cheeky.com.ar id28273 View details	2026-04-17	Argentina	Retail / E-commerce	—
Cheeky is a well-established Argentine children’s fashion brand owned by CHEEK S.A., headquartered in Martínez, Buenos Aires Province. Founded in … ID 28273
Ransomware	abfall-kreis-kassel.de id28272 View details	2026-04-17	Germany	Public Sector	—
The website abfall-kreis-kassel.de represents the Abfallentsorgung Kreis Kassel, a publicly owned waste management entity (Eigenbetrieb) operated by the district of … ID 28272
Ransomware	genealogysa.org.au id28271 View details	2026-04-17	Australia	NGOs / Associations	pending
Genealogy SA, formally known as the South Australian Genealogy & Heraldry Society, is a leading Australian nonprofit organisation dedicated to … ID 28271
Ransomware	lynxprecast.co.uk id28270 View details	2026-04-17	United Kingdom	Manufacturing / Engineering	—
Lynx Precast Ltd is a UK-based construction manufacturing company specialising in the design, manufacture and installation of precast concrete products … ID 28270
Ransomware	thruwayplumbingservice.com id28269 View details	2026-04-17	United States	Services	—
The business provides standard residential and commercial plumbing services, including: - Leak detection and pipe repair - Drain cleaning and … ID 28269
Ransomware	favellefavco.com id28268 View details	2026-04-17	Malaysia	Manufacturing / Engineering	—
Favelle Favco is a leading manufacturer of heavy-duty cranes, including: - tower cranes - offshore cranes - wharf and marine … ID 28268
Ransomware	st-bernards.bham.sch.uk id28267 View details	2026-04-17	United Kingdom	Education	—
St Bernard’s provides primary education for children, including: English, maths, science and general curriculum subjects Religious education (Catholic values are … ID 28267
Ransomware	academyhealth.org id27937 View details	2026-04-06	United States	NGOs / Associations	pending
Is a U.S.-based nonprofit professional organization headquartered in Washington, D.C., dedicated to advancing the fields of health services research and … ID 27937
Ransomware	brookercg.com id27395 View details	2026-03-17	United States	Construction / Real Estate	pending
Is a privately held general contracting and construction management company headquartered in Chattanooga, Tennessee, United States. The firm specializes in … ID 27395
Ransomware	tiefenbachergroup.com id27394 View details	2026-03-17	Germany	Healthcare / Pharma	—
Is a 100% family-owned, leading global healthcare company founded in 1963 and based in Hamburg, Germany. The company operates across … ID 27394
Ransomware	briwaycarriers.com id27393 View details	2026-03-17	Canada	Agriculture / Food	—
Ontario-based transportation company specializing in specialized freight, including a dedicated glass division and agricultural services. They offer global supply chain … ID 27393
Ransomware	mattandsteve.com id27392 View details	2026-03-17	Canada	Manufacturing / Engineering	—
Is a Canadian food manufacturer based in Mississauga, Ontario, founded in 2000 by Matthew Larochelle and Steve McVicker. Known for … ID 27392
Ransomware	thenavigatorcompany.com id27391 View details	2026-03-17	Portugal	Manufacturing / Engineering	—
Is a major Portuguese producer of forestry, pulp, paper, tissue, and sustainable packaging solutions, recognized as Europe's largest manufacturer of … ID 27391
Ransomware	smileteam.com.au id27140 View details	2026-03-06	Australia	Healthcare / Pharma	—
Is a privately owned Australian healthcare company specialising in orthodontic treatment and dental alignment services. The organisation was founded around … ID 27140
Ransomware	ripobec.com id27037 View details	2026-03-03	Canada	Agriculture / Food	—
Is a Canadian family-owned agricultural supply company headquartered in Saint-Apollinaire, Quebec, specialising in the production and distribution of premium wood … ID 27037
Ransomware	Franz-Sales-Haus.de id27033 View details	2026-03-03	Germany	Retail / E-commerce	—
Located at Steeler Straße 261, 45138 Essen, is a support organization dedicated to empowering people with disabilities to live self-determined … ID 27033
Ransomware	atadler.com.sg id26366 View details	2026-02-07	Singapore	Finance / Legal / Insurance	pending
Is a Singapore-based accounting, auditing and bookkeeping services firm that has been operating as a registered partnership since 25 October … ID 26366
Ransomware	kres.cz id26365 View details	2026-02-07	Czechia	Retail / E-commerce	—
Czech small-to-medium enterprise headquartered in Krnov – Pod Cvilínem, Czech Republic. The company specialises in the sale, repair and servicing … ID 26365
Ransomware	groupepiche.ca id26364 View details	2026-02-07	Canada	Construction / Real Estate	pending
Is a privately held Canadian construction and interior systems company headquartered in Ferme-Neuve, Québec with additional offices in Boisbriand (QC), … ID 26364
Ransomware	freidarothman.com id25835 View details	2026-01-26	United States	Other	pending
Based jewelry and accessories brand founded and led by designer Freida Rothman, who grew up in Brooklyn and comes from … ID 25835
Ransomware	gsglobalresources.com id25753 View details	2026-01-24	United States	Manufacturing / Engineering	—
GS Global Resources (often abbreviated GSGR) is an American industrial engineering and machine-performance solutions company headquartered in Mukwonago, Wisconsin. Founded … ID 25753
Ransomware	lcpublishinggroup.com id25752 View details	2026-01-24	Italy	Services	—
LC Publishing Group S.p.A. is an international digital publishing and information services company headquartered in Milan, Italy. Founded in 2011, … ID 25752
Ransomware	adifse.com.ar id25751 View details	2026-01-24	Argentina	Retail / E-commerce	—
ADIFSE — formally the Administración de Infraestructuras Ferroviarias Sociedad del Estado — is a state-owned railway infrastructure company in Argentina … ID 25751
Ransomware	trulinemfg.com id25750 View details	2026-01-24	United States	Manufacturing / Engineering	—
Tru-Line Manufacturing Company is an American industrial fabrication firm headquartered in Decatur, Alabama that specialises in the metal fabrication of … ID 25750
Ransomware	superiordrywall.com id25749 View details	2026-01-24	United States	Other	—
Superior Drywall is an established American commercial drywall contracting company based in Oxnard, California, specialising in a range of interior … ID 25749
Ransomware	interr.com id25748 View details	2026-01-24	United Kingdom	Services	pending
Interr is a privately held security and risk-management services company headquartered at The Loom, 14 Gower’s Walk, London, UK. Established … ID 25748
Ransomware	rlc.es id25730 View details	2026-01-23	Spain	Transportation / Travel / Logistics	—
RLC Transportes (operating under Rau Load Cargo, S.L.) is a Spanish logistics and freight-transport company based in El Puig de … ID 25730
Ransomware	abcseamless.com id25607 View details	2026-01-19	United States	Manufacturing / Engineering	—
ABC Seamless is a U.S.-based home improvement and exterior construction company that specialises in custom on-site manufactured seamless steel siding, … ID 25607
Ransomware	wohnverbund-st-gertrud.de id25606 View details	2026-01-19	Germany	Services	—
Wohnverbund St. Gertrud is a German social care and residential support organisation located in Morsbach, North Rhine-Westphalia, Germany. It operates … ID 25606
Ransomware	ipu.co.il id25605 View details	2026-01-19	Israel	Manufacturing / Engineering	pending
IPU Industries Ltd. is a privately held Israeli industrial manufacturing company headquartered in Kiryat Gat, Israel, specialising in advanced plastic … ID 25605
Ransomware	setex-textil.de id25217 View details	2025-12-29	Germany	Communication / Marketing	—
SETEX-Textil GmbH is a vertically integrated German textile manufacturer headquartered in Hamminkeln-Dingden, North Rhine-Westphalia. The company operates comprehensive textile production … ID 25217
Ransomware	davidrosenbakerysupply.com id25216 View details	2025-12-29	United States	Other	—
David Rosen Bakery Supply is a long-established wholesale bakery supply and distribution company headquartered in Maspeth, New York, serving commercial … ID 25216
Ransomware	knightgroup.co.uk id25215 View details	2025-12-29	United Kingdom	Communication / Marketing	—
Knight Group is a UK-based precision metal stockist and processor with a long history dating back to 1943. The company … ID 25215
Ransomware	moorelumber.com id25214 View details	2025-12-29	United States	Retail / E-commerce	pending
Moore Lumber & Hardware Co. is a U.S. building-materials retailer and hardware supplier based in Ayer, Massachusetts. Founded in the … ID 25214
Ransomware	usdaw.org.uk id25213 View details	2025-12-29	United Kingdom	Retail / E-commerce	—
Usdaw — formally the Union of Shop, Distributive and Allied Workers — is one of the United Kingdom’s largest and … ID 25213
Ransomware	investigacionesmedicas.com id25212 View details	2025-12-29	Argentina	Communication / Marketing	pending
Investigaciones Médicas is a private medical diagnostics and imaging services provider based in Buenos Aires, Argentina. Founded in 1991, it … ID 25212
Ransomware	sproutnet.com id25211 View details	2025-12-29	United States	Communication / Marketing	—
SproutNet — operating under International Specialty Supply — is a U.S. producer and supplier of sprouting seeds, sprouts, natural ingredients … ID 25211

Safepay

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (5)

Top Activity Sectors (16)