Ransomware Group intelligence
Safepay
ActiveTrack Safepay with 616 published victims and 5 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Safepay is tracked by Breach House as a ransomware group with 616 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
140
- Leaked 0 0.0%
- Pending 139 99.3%
- Deleted 1 0.7%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 5 | Onion service | Up checked 5h ago | safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion |
| Leak location 4 | Onion service | Down checked 5h ago | j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion |
| Leak location 3 | Onion service | Down checked 5h ago | nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion |
| Leak location 2 | Onion service | Down checked 5h ago | cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion |
| Leak location 1 | Onion service | Down checked 5h ago | nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion |
Top Activity Sectors (16)
- Not identified 144
- Communication / Marketing 93
- Manufacturing / Engineering 54
- Services 38
- Construction / Real Estate 31
- IT 30
- Healthcare / Pharma 28
- Finance / Legal / Insurance 27
- Education 25
- Retail / E-commerce 22
- Agriculture / Food 15
- Transportation / Travel / Logistics 14
- Public Sector 13
- Hospitality / Food & Beverage / Tourism 12
- NGOs / Associations 9
- Energy 4
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.016 Junk Code Insertion Stealth
What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (8)
▼Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery
Invoke-ShareFinder
Exfiltration
FileZilla
7zip
WinRAR
LOLBAS (living-off-the-land binaries)
Regsvr32.exe
CMSTPLUA
dllhost.exe
RMM Tools
Microsoft RDP
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme_safepay.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
readme_safepay_ascii.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (616)
Search, filter and paginate the victim timeline for Safepay. Showing 501–600 of 616.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | swr.school id18829 View details | Germany | Education | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | albrecht-partner-steuerberatung.de id18828 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] Albrecht & Partner Steuerberatung is a German Tax Advisory company headquartered in Frankfurt. With expertise in accounting, auditing, and tax services, the company largely caters to small and medium-sized enterprises, assisting them in tax planning and compliance. They prioritize individual consultations, tailored solutions, and personal service for their clients. The firm prides itself on its competence, commitment, and the continuity of its client relationships. |
||||||
| Ransomware | alpsteel.com id18827 View details | Türkiye | Manufacturing / Engineering | — | ||
|
[AI generated] "AlpSteel.com" is an online platform for one of the leading steel and metal distributors, AlpSteel. Their products include a wide range of steel materials for various industries, such as construction, automotive, shipping, and others. They focus on providing high-quality products alongside efficient delivery services. Their offerings include stainless steel, carbon steel, copper, brass, aluminum, and more. |
||||||
| Ransomware | blunk-gmbh.de id18826 View details | Germany | Agriculture / Food | — | ||
|
[AI generated] Blunk GmbH is a German company that specializes in agricultural services. It operates in three main sectors: agriculture, renewable energies, and machinery. In agriculture, they offer services like soil cultivation, sowing, plant protection, and harvesting. Their renewable energies division manages biogas plants and wind turbines. In the machinery sector, they sell, rent, and repair various agricultural machines. |
||||||
| Ransomware | cjs-buerodienstleistungen.de id18825 View details | Germany | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | beaudry.ca id18824 View details | Canada | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | bohrerhof.de id18823 View details | Germany | Agriculture / Food | — | ||
|
[AI generated] "Bohrerhof.de" is a German-based company mainly dealing with agriculture and farming. The company primarily specializes in through farming, fish farming, and renewable energies, contributing significantly to sustainable agriculture. They offer various products from their farming including, fruits, vegetables, and produce from their bakery and butchery. They also facilitate visits and tours to their farm for a firsthand exploration experience. |
||||||
| Ransomware | metalogicinspection.com id18822 View details | United States | Manufacturing / Engineering | — | ||
|
[AI generated] Metalogic Inspection Services is a company noted for its groundbreaking solutions in non-destructive testing (NDT). The firm focuses on using innovative technology and methods of inspection to enhance sustainability and efficacy. Its services range to various sectors from oil and gas to power generation, providing assistance in identifying equipment defects and ensuring safety and efficiency. |
||||||
| Ransomware | comfort.de id18821 View details | Germany | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | vcvitanzasons.com id18820 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | tramann.de id18819 View details | Germany | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | schuhbode.de id18818 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] "Schuhbode.de" is a Germany-based online retail store that specializes in selling a wide variety of footwear for men, women, and children. Offering products from well-known brands, their collection ranges from trendy sneakers, boots, high heels to comfortable sandals and slippers. They emphasize providing high-quality shoes at competitive prices along with good customer service. |
||||||
| Ransomware | norson.com id18817 View details | Mexico | Construction / Real Estate | — | ||
|
[AI generated] NorSon Inc. is a custom integrated construction service firm specializing in high-end residential and commercial projects. This Minnesota-based company is dedicated to providing their clients with excellent craftsmanship and personal service. They offer services in architecture, construction, designing, maintenance for luxury homes and commercial structures. NorSon's use of cutting-edge technology and attention to detail sets them apart in the industry. |
||||||
| Ransomware | fd-friedrich.com id18816 View details | Germany | Other | — | ||
|
[AI generated] "N/A" |
||||||
| Ransomware | westwarwickwelding.com id18815 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | prestigeer.com id18814 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Prestige ER is a medical care organization located in Plano, Texas. Open 24/7, this emergency room provides immediate treatment for life-threatening conditions like heart attacks and strokes, as well as less severe issues like minor fractures and cuts. Their team of professionals includes board-certified physicians and experienced staff that utilize advanced facilities for quick diagnosis and treatments. This ER is independent from any hospital system and offers little to no wait time. |
||||||
| Ransomware | ecconstructors.com id18813 View details | United States | Communication / Marketing | — | ||
|
[AI generated] EC Constructors is a construction company involved in public works projects in Southern California. They specialize in water and wastewater treatment facilities, pump stations, bridges, and structural concrete. The company has completed thousands of projects, boasting versatility and a team oriented approach. They stress the importance of safety and quality in all they do. |
||||||
| Ransomware | wrm.org id18812 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | retycol.com id18811 View details | Colombia | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | marcom-inc.ca id18810 View details | Canada | Communication / Marketing | — | ||
|
[AI generated] Marcom Inc. is a Canadian company providing businesses with safety training solutions. Their primary offerings include digital, online, and DVD training in multiple languages, compliance tracking and reporting, as well as customizable content. Their programs are aimed at various sectors including construction, transportation, and manufacturing. |
||||||
| Ransomware | adolphelawgroup.com id18809 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | wagner-transporte.com id18808 View details | Germany | Transportation / Travel / Logistics | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | children-ne.org.uk id18807 View details | United Kingdom | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | mayaassurance.com id18806 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Maya Assurance Company is a New York-based insurance firm that specializes in auto insurance. It serves customers predominately in the local areas, providing a wide range of coverages including liability, collision, comprehensive, uninsured motorist, and personal injury protection. Maya Assurance Company distinguishes itself by offering personalized services and affordable rates. |
||||||
| Ransomware | saiedu.fi id18709 View details | Finland | Education | — | ||
|
[AI generated] Saiedu.fi, known as SAI Education and Development Finland, is a Finland-based company that aims to support education and development globally. This organization works to improve school systems, teachers' professional development, and curriculum design. SAI offers a range of services, from training courses and seminars to consultancy services in education and development. |
||||||
| Ransomware | compassionhealthcare.org id18600 View details | Healthcare / Pharma | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | terrell.k12.ga.us id18472 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | argusdatainsights.de id18423 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] Argus Data Insights is a German company that specializes in media monitoring and analysis. They provide businesses with important insights and intelligence on their media presence and public perception. Their services include tracking, documenting, and analyzing traditional and digital media to help clients make informed decisions. Argus Data Insights combines technology with experienced media experts to deliver comprehensive media intelligence. |
||||||
| Ransomware | tradingacademy.com id18344 View details | United States | Education | — | ||
|
[AI generated] Trading Academy is a financial education provider that offers online and in-person courses for individuals interested in learning about trading and investing. They provide education in fields such as stocks, Forex, futures, and options. Their courses cater to beginners as well as seasoned investors, and they are known for their interactive learning experience and hands-on training methods. |
||||||
| Ransomware | ultimateclasslimo.com id18343 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Ultimate Class Limo is a professional transportation company based in New York. It offers a wide collection of luxury vehicles like limousines, buses, vans, SUVs and cars for various events. Its services range from corporate transport and airport transfers to special events like weddings, proms, and tours. With professionally trained drivers and quality service, it prioritises comfort and safety. It also provides customised travel solutions based on clients' individual needs. |
||||||
| Ransomware | havenresorts.com id18342 View details | Mexico | Hospitality / Food & Beverage / Tourism | — | ||
|
Enjoy sanctuary of luxury and sophistication at Haven Riviera Cancun, an adults-only, all-inclusive resort located between Cancun & Riviera Maya. |
||||||
| Ransomware | lgipr.com id18341 View details | United States | Communication / Marketing | — | ||
|
[AI generated] LGIPR.com appears to be a Russian company that offers various services in the field of intellectual property rights. These services may include patent registration, trademarks, copyright, license agreements, assessment of intellectual property, and more. However, due to limited information available online and possible language barriers, specifics about the company can be scarce. |
||||||
| Ransomware | jockeysalud.com.pe id18340 View details | Peru | Healthcare / Pharma | — | ||
|
[AI generated] "Jockeysalud.com.pe" is a healthcare institution based in Lima, Peru. They are committed to providing the highest quality of health service to the public. Their main wings include specialized healthcare, preventive medicine, medical examination, nursing services, and emergency care. They are highly equipped with cutting-edge medical technology and professional medical staff to enhance their service standards. |
||||||
| Ransomware | motomecanica.com id18339 View details | Spain | Communication / Marketing | — | ||
|
[AI generated] Motomecanica.com is renowned for its expertise in the production and supply of high-quality main propulsion equipment and deck machinery for ships. The company's rigorous quality checks, innovative designing, and manufacturing ensure its products are reliable and efficient. They serve a diverse client base worldwide, including naval markets. Their product range includes gearboxes, winches, hydraulic systems, and more. |
||||||
| Ransomware | cali.losolivos.co id18338 View details | Colombia | Communication / Marketing | — | ||
|
[AI generated] I'm sorry, but there doesn't seem to be enough verifiable or specific information available about a company by the name "cali.losolivos.co". It's possible that you may be referring to "Los Olivos", which is a well-known funeral services company in Colombia. However, without more specific details, it's difficult to provide a thorough description. Please provide more information. |
||||||
| Ransomware | willms-fleisch.de id18188 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] Willms-Fleisch GmbH is a Germany-based company known for providing high quality meat products. The company specializes in the import and export, processing, and sales of high-quality pork, beef, and other meat products. Their expertise includes individual cuts for various culinary requirements, and special meat products for industrial users. They boast more than 50 years in the industry, signaling a strong reputation for both domestic and international customers. |
||||||
| Ransomware | plasseramerican.com id18101 View details | United States | Manufacturing / Engineering | — | ||
|
[AI generated] Plasser American Corporation is an eminent manufacturer of heavy machinery and equipment designed for maintenance of way (MOW) on railroads. They offer an extensive range of advanced machines and systems such as track laying machines, tampers, stabilizers, ballast distributing and profiling machinery, and other track maintenance equipment. The company is known for their high-quality products that significantly increase the life-cycle of rail tracks. |
||||||
| Ransomware | conduent.com id17679 View details | United States | Services | — | ||
|
[AI generated] Conduent is a global company specializing in business process services. They provide digital platforms and services for both businesses and governments. Conduent's expertise covers sectors like healthcare, transportation, and financial services among others. Their services aim to improve user experiences, boost operational efficiency and increase client satisfaction. They were formerly a part of Xerox. |
||||||
| Ransomware | ziese.net id17648 View details | Germany | Communication / Marketing | — | ||
|
Ziese & Sons Excavating, Inc. is your premier excavation company serving Crown Point and the surrounding areas. Contact us today for a free consultation. |
||||||
| Ransomware | rwrhine.com id17647 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Rwrhine.com is a professional dental practice led by Dr. Richard W. Rhine, a reputed dentist renowned for his expertise in general and cosmetic dentistry. The practice is located in Hayward, California, and is dedicated to offering personalized service and comprehensive dental care. The company's services ranges from preventive care and routine cleanings to restorative procedures and cosmetic treatments. |
||||||
| Ransomware | foyernotredamedepaix.be id17646 View details | Belgium | Healthcare / Pharma | — | ||
|
[AI generated] Foyernotredamedepaix.be is a Belgian healthcare company that specializes in treating people with mental illnesses and disabilities. The company provides personalized care plans focusing on respect, autonomy, and personal development while preserving patients' dignity. They offer aid to families affected by such illnesses and aim to create a peaceful, supportive environment for each individual under their care. |
||||||
| Ransomware | fastrans.com id17645 View details | United States | Transportation / Travel / Logistics | — | ||
|
Fastrans Logistics |
||||||
| Ransomware | stjerome.org id17496 View details | United States | Education | — | ||
|
[AI generated] Stjerome.org appears to be a non-existent or unrecognized company. The name "St Jerome" is often associated with religious institutions, specifically Roman Catholic churches or schools, as St. Jerome is recognized as a saint in the Catholic faith. Without additional information or a functioning website, it's challenging to provide an accurate description of the entity referenced by "stjerome.org". |
||||||
| Ransomware | harcoboe.net id17256 View details | Denmark | Communication / Marketing | — | ||
|
[AI generated] "Harcoboe.net" is a webmail service provided by Harrison County Board of Education in the United States. This platform enables seamless communication within their education system, primarily used by staff members for professional electronic communication. They offer a secure, efficient and user-friendly email system improving operational efficiency within the Harrison County Schools. |
||||||
| Ransomware | lowernazareth.com id17255 View details | United States | Communication / Marketing | — | ||
|
[AI generated] "lowernazareth.com" appears to be a community-focused site serving the residents of Lower Nazareth, a township in Pennsylvania. The company offers local information, news, events, community updates and resources. It may also play a role in promoting local businesses and supporting community engagement. However, precise details of the company could not be found, which suggests it might not be widely recognized or could be newly established. |
||||||
| Ransomware | www.iecsolutions.com id17240 View details | United States | Services | — | ||
|
[AI generated] IEC Solutions is a telecommunication company specializing in designing, installing, and maintaining complex fiber-optic and copper communication networks. They offer a wide array of services including network design, project management, cable installation and upgrading, and communication room build-outs. Their clientele spans across both the public and private sectors. The company is committed to quality, safety and harnessing the latest technology. |
||||||
| Ransomware | brewsterfiredepartment.org id17153 View details | United States | Public Sector | — | ||
|
[AI generated] "Brewster Fire Department" appears to be a fire and emergency service provider based in Brewster, likely in the United States. As a fire department, they are likely responsible for providing rapid, professional response to fires, medical emergencies, and other incidents that threaten public safety. They may also offer public educational programs focused on fire safety, emergency preparedness, and related topics. Note that more specific information may vary by location. |
||||||
| Ransomware | derrimon.com id17152 View details | Jamaica | Communication / Marketing | — | ||
|
[AI generated] Derrimon Trading Company Limited is a Jamaican-based firm engaged in the distribution and trading of a wide array of product categories from food items to personal care. The company has also ventured into retail with the acquisition of Sampars Cash and Carry, and operates numerous supermarkets throughout Jamaica. Derrimon aims to consistently provide its customers with high quality products while prioritizing sustainable growth. |
||||||
| Ransomware | globexusa.com id17151 View details | United States | Services | — | ||
|
[AI generated] GlobexUSA is a company that specializes in cross-border e-commerce solutions, helping businesses expand their reach globally. It offers services such as international logistics, web development, and online marketing. They also provide services to help businesses deal with aspects like taxation, regulatory compliance, customs and international payments. It is a versatile solution for businesses aiming to extend their operations internationally. |
||||||
| Ransomware | muscogee.k12.ga.us id16960 View details | United States | Education | — | ||
|
[AI generated] Muscogee.k12.ga.us is the official web portal for the Muscogee County School District, located in Georgia, USA. They aim to inspire and equip all students to achieve unlimited potential. The website provides resources including information about schools in the district, educational programs, staff contacts, calendar events, and various student and parent services. |
||||||
| Ransomware | bigotti.ro id16862 View details | Romania | Communication / Marketing | — | ||
|
[AI generated] Bigotti.ro is a Romania-based fashion company specializing in men's clothing and accessories. Known for its high-quality Italian design, the brand offers a wide selection of items such as suits, shirts, shoes, and ties. They focus on providing stylish, yet comfortable apparel that suits both formal and casual occasions. Customer service and satisfaction are at the core of their values. |
||||||
| Ransomware | mcpathology.com id16861 View details | Australia | Healthcare / Pharma | — | ||
|
[AI generated] McPathology.com is essentially a Brisbane-based medical diagnostic service and laboratory that provides a wide range of pathology testing services. It is fully accredited by the Royal College of Pathologists of Australia. Professional pathologists, doctors, and health professionals rely on it to deliver accurate results with the aim of diagnosing, treating, and monitoring diseases and health conditions more effectively. |
||||||
| Ransomware | nutripack.eu id16860 View details | France | Agriculture / Food | — | ||
|
[AI generated] Nutripack.eu is a prominent international company based in Europe that specializes in the manufacturing and sales of sustainable food packaging. The company offers innovative, eco-friendly solutions for food packaging, ranging from recyclable trays to bio-degradable options. Established with the goal of reducing plastic wastage, Nutripack's strategic commitment revolves around environmental responsibility and creativity. They cater to various sectors including catering, agri-food industries, and healthcare. |
||||||
| Ransomware | paradiseschools.org id16859 View details | United States | Education | — | ||
|
[AI generated] Paradise Schools is a network of K-12 charter schools located in Surprise, Arizona. The organization, established in 1997, comprises three schools - Paradise Honors High School, Paradise Honors Middle School, and Paradise Education Center. It offers a comprehensive curriculum aligned with state and national standards. The student-centric institution strives to cultivate creativity, critical thinking, leadership, and character development in a safe and inclusive environment. |
||||||
| Ransomware | welcomewagon.com id16858 View details | United States | Services | — | ||
|
[AI generated] Welcome Wagon is a US-based company focused on creating connections between new homeowners, movers and local businesses. They specialize in welcoming new residents to their community, introducing them to products and services of local businesses through direct mail marketing, digital marketing services, and gift books. They aim to stimulate local economic growth by fostering these new relationships. |
||||||
| Ransomware | cellsciencesystems.com id16857 View details | United States | Healthcare / Pharma | — | ||
|
[AI generated] Cell Science Systems is a specialty clinical laboratory that develops and performs laboratory testing in immunology and cell biology to assist healthcare providers in the diagnosis, treatment, and monitoring of complex disorders. The company is notable for pioneering the Alcat Test for food and chemical sensitivities. The tests support the personalized treatment plans for conditions like digestion issues, migraines, obesity, chronic fatigue, aching joints, skin disorders, etc. |
||||||
| Ransomware | BBBIND.COM id16771 View details | United States | Communication / Marketing | — | ||
|
[AI generated] BBBIND.COM is a leading American company specialized in automotive aftermarket parts. It sells premium parts, particularly offering high-quality rotating electrical products. The company’s product portfolio includes alternators, starters, brake calipers, power steering products, etc. They also provide their customers with technical diagnostic support and information to ensure the correct product usage. |
||||||
| Ransomware | gaylord.org id16767 View details | Other | — | |||
|
No additional victim description available. |
||||||
| Ransomware | semesco.com id16752 View details | Cyprus | Retail / E-commerce | — | ||
|
[AI generated] Semesco.com is an e-commerce platform that allows users to buy and sell a variety of products across different categories. These include electronics, clothing, beauty products, household items, and more. It also facilitates secure online transactions and provides delivery services to customers. Moreover, Semesco supports local brands and businesses by helping them reach a wider customer base. They focus on providing an enhanced shopping experience with a user-friendly website and customer service. |
||||||
| Ransomware | brunetti.com id16751 View details | Australia | Hospitality / Food & Beverage / Tourism | — | ||
|
[AI generated] Brunetti is a renowned Italian cafe established in Melbourne, Australia in 1985. Known for its European ambiance and authentic Italian food, Brunetti offers a wide range of options including gourmet pizza, pasta, gelato and one of Melbourne's most extensive ranges of Italian pastries, cakes and desserts. They also provide catering and online takeaway ordering services. |
||||||
| Ransomware | solge.es id16750 View details | Spain | IT | — | ||
|
[AI generated] Solge.es is a Spanish-based Information Technology company primarily focusing on the development of mobile applications, web design, and digital marketing. They aim to increase the effectiveness of enterprises by offering comprehensive IT solutions and digital marketing strategies. Besides these services, they provide training and consultancy in the field of web design and digital marketing. |
||||||
| Ransomware | gonzalesusd.net id16708 View details | United States | Education | — | ||
|
[AI generated] I'm sorry for the confusion but gonzalesusd.net is not a company. It's actually the domain for the Gonzales Unified School District in Gonzales, California, primarily responsible for all public education in the city. It incorporates various levels of education including elementary, middle, and high school. It works to create enriching, engaging environments for students, teachers and staff. |
||||||
| Ransomware | platinumcollision.com id16692 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Platinum Collision is a reputed automotive repair company specializing in car body repair and paint services. They provide high-quality restorative solutions to vehicle owners, promising excellent craftsmanship, advanced equipment, and certified technicians. They ensure full collision repairs in line with vehicle manufacturer standards. Customer satisfaction, consistency in deliverance and commitment to quality makes Platinum Collision a preferred choice for many. |
||||||
| Ransomware | safecoastseafoods.com id16677 View details | United States | Agriculture / Food | — | ||
|
[AI generated] Safecoast Seafoods is a premium seafood sourcing and distribution company. They are focused on delivering the highest quality fresh and frozen seafood to various markets. They partner with sustainable fisheries worldwide, ensuring they offer a wide variety of species. Their services include wholesale distribution, home delivery and even private labeling, meeting the needs of restaurants, markets, and individual consumers alike. |
||||||
| Ransomware | greyform.sg id16676 View details | Singapore | Construction / Real Estate | — | ||
|
[AI generated] Greyform Pte Ltd is a Singapore-based construction company specialising in prefab construction methods. With a focus on sustainability and high-efficiency construction, Greyform uses innovative techniques to meet the demands of today's construction industry. Their services include the design, production, logistics and installation of prefabricated components for residential, commercial and civil engineering projects. |
||||||
| Ransomware | proexequialesresurgir.com id16675 View details | Colombia | Communication / Marketing | — | ||
|
Inicio | Proexequiales Resurgi |
||||||
| Ransomware | bellandgraham.co.nz id16674 View details | New Zealand | Hospitality / Food & Beverage / Tourism | — | ||
|
Back in 1954, a man named Ray Kroc discovered a small burger restaurant in California, and wrote the first page of our history. From humble beginnings as a small restaurant, we're proud to have become one of the world's leading food service brands with more |
||||||
| Ransomware | termopuerto.com id16673 View details | El Salvador | Communication / Marketing | — | ||
|
[AI generated] Termopuerto.com is a logistics company specializing in the integral control of perishable goods. With its operations based in Guatemala, the company ensures efficient and safe handling of products during transportation and storage. It provides advanced temperature-controlled solutions ideal for preserving the quality of goods like fruits, vegetables, and seafood among others. Its services include pre-cooling, packing, labeling, inventory management and customs services. |
||||||
| Ransomware | equipo-postal.com id16672 View details | Mexico | Services | — | ||
|
[AI generated] Equipo Postal is a Mexican company that specializes in logistics and delivery services. They offer comprehensive solutions for mail and parcel deliveries, e-commerce distribution, and personalized logistics strategies. With a focus on innovation, they utilise advanced technology to provide efficient and reliable services. Dedicated to customer satisfaction, Equipo Postal Implements custom solutions to meet individual business needs. All while remaining eco-friendly and sustainably focused. |
||||||
| Ransomware | ddelta.com.mx id16671 View details | Mexico | Communication / Marketing | — | ||
|
[AI generated] Ddelta.com.mx is a Mexico-based company that specializes in offering software solutions and automation services. Their products and services span across various industries including energy, mining, chemical, food and beverage, and more. They offer solutions that optimize processes, improve production efficiency, reduce operating costs and increase profitability. These include programming, instrumentation, electrical design, etc. The company prides itself on its customer-centric approach. |
||||||
| Ransomware | royalinsignia.com id16446 View details | Singapore | Other | — | — | |
|
Revenue $6.5 Million |
||||||
| Ransomware | starkvillesd.com id16445 View details | United States | Other | — | — | |
|
Revenue $9.1 Million |
||||||
| Ransomware | spiro.k12.ok.us id16444 View details | United States | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | byronunionschooldistrict.us id16443 View details | United States | Education | — | — | |
|
Revenue $19.3 Million |
||||||
| Ransomware | multicoasia.com id16442 View details | Singapore | Other | — | — | |
|
Revenue $11.6 Million |
||||||
| Ransomware | dprinvestments.com id16441 View details | Anguilla | Finance / Legal / Insurance | — | — | |
|
Revenue $13 Million |
||||||
| Ransomware | UPR.SG id16440 View details | Singapore | Communication / Marketing | — | — | |
|
Revenue $8.9 Million |
||||||
| Ransomware | itca.edu.sv id16389 View details | El Salvador | Other | — | — | |
|
Revenue $56.5 Million |
||||||
| Ransomware | etplaw.com id16388 View details | United Arab Emirates | Finance / Legal / Insurance | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | muswellbrook.nsw.gov.au id16034 View details | Australia | Other | — | — | |
|
Soon |
||||||
| Ransomware | cityofmarlow.com id15999 View details | United Kingdom | Public Sector | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | nbkenney.com id15998 View details | United States | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | casaimports.com id15885 View details | United States | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | ktpartners.ca id15884 View details | Canada | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | elwood.k12.in.us id15704 View details | United States | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | scottelec.com id15703 View details | United States | Other | — | — | |
|
Revenue $19.6 Million |
||||||
| Ransomware | helixbermuda.bm id15702 View details | Bermuda | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | australianhearthealth.org.au id15701 View details | Australia | Healthcare / Pharma | — | — | |
|
Revenue $7 Million |
||||||
| Ransomware | midlandtool.com id15700 View details | United States | Other | — | — | |
|
Revenue $126 Million |
||||||
| Ransomware | mdmcusa.com id15644 View details | United States | Other | — | — | |
|
Revenue $5 Million |
||||||
| Ransomware | titlenine.com id15605 View details | United States | Other | — | — | |
|
Revenue $60.8 Million |
||||||
| Ransomware | www.microlise.com id15547 View details | United Kingdom | Other | — | — | |
|
Revenue $91.4 Million |
||||||
| Ransomware | snowbrand.com.au id15521 View details | Australia | Other | — | — | |
|
Revenue $9.5 Million |
||||||
| Ransomware | piburners.com id15520 View details | United States | Other | — | — | |
|
ZIP-156GB - Revenue $5 Million |
||||||
| Ransomware | tritonsourcing.co.nz id15519 View details | New Zealand | Other | — | — | |
|
ZIP-10GB - Revenue $5 Million |
||||||
| Ransomware | onnicar.it id15518 View details | Italy | Other | — | — | |
|
ZIP-127GB - Revenue $23.2 Million |
||||||
| Ransomware | kingswoodpark.ca id15517 View details | Canada | Other | — | — | |
|
ZIP-55GB |
||||||
| Ransomware | incocommercial.com id15516 View details | United States | Services | — | — | |
|
ZIP-210GB - Revenue $5 Million |
||||||
| Ransomware | euromedix.com id15515 View details | Belgium | Other | — | — | |
|
ZIP-105GB - Revenue $6.2 Million |
||||||
| Ransomware | BusinessTraining.be id15514 View details | Belgium | Education | — | — | |
|
ZIP-80GB - Revenue $16.3 Million |
||||||