Ransomware Group intelligence
Safepay
ActiveTrack Safepay with 595 published victims and 5 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Safepay is tracked by Dark Eye as a ransomware group with 595 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
595
- Leaked 153 25.7%
- Pending 440 73.9%
- Deleted 2 0.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 5 | Onion service | Up checked 25m ago | safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion |
| Leak location 2 | Onion service | Down checked 25m ago | cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion |
| Leak location 4 | Onion service | Down checked 26m ago | j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion |
| Leak location 3 | Onion service | Down checked 26m ago | nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion |
| Leak location 1 | Onion service | Down checked 26m ago | nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion |
Top Activity Sectors (17)
- Not identified 146
- Communication / Marketing 94
- Manufacturing / Engineering 60
- Services 43
- IT 36
- Construction / Real Estate 31
- Healthcare / Pharma 29
- Finance / Legal / Insurance 27
- Retail / E-commerce 25
- Education 25
- Agriculture / Food 17
- Public Sector 14
- Transportation / Travel / Logistics 14
- Hospitality / Food & Beverage / Tourism 13
- NGOs / Associations 10
- Energy 4
- null 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.016 Junk Code Insertion Stealth
What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (8)
▼Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery
Invoke-ShareFinder
Exfiltration
FileZilla
7zip
WinRAR
LOLBAS (living-off-the-land binaries)
Regsvr32.exe
CMSTPLUA
dllhost.exe
RMM Tools
Microsoft RDP
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme_safepay.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
readme_safepay_ascii.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (595)
Search, filter and paginate the victim timeline for Safepay. Showing 101–200 of 595.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | musenet.co.jp id29902 View details | Japan | IT | leaked | ||
|
Founded in the twentieth century, the company serves as an intermediary between publishers and music retailers throughout Japan. Its online … |
||||||
| Ransomware | bautz-maschinenbau.de id29903 View details | Germany | Manufacturing / Engineering | pending | ||
|
Founded in 1960 by Alfred Bautz, the family-owned enterprise has developed over three generations into a specialized supplier of precision … |
||||||
| Ransomware | aquaclean.com id29904 View details | Spain | Healthcare / Pharma | pending | ||
|
The company operates as part of Interfabrics S.L. and has more than 50 years of experience in the textile industry. … |
||||||
| Ransomware | hoodriversheriff.com id29905 View details | United States | Public Sector | leaked | ||
|
Headquartered in Hood River, the organization provides a broad range of services, including patrol operations, criminal investigations, emergency communications, search … |
||||||
| Ransomware | iql-nog.com id29571 View details | Spain | Other | leaked | ||
|
Founded in 1947, the company specializes in the production of oleochemical products, particularly fatty acid esters and specialty chemicals derived … |
||||||
| Ransomware | tavolaspa.com id29548 View details | Italy | Hospitality / Food & Beverage / Tourism | pending | ||
|
Over more than seventy years of operation, the company has evolved from an import-export business into a diversified manufacturer, distributor, … |
||||||
| Ransomware | parsa-beauty.de id29549 View details | Germany | Retail / E-commerce | pending | ||
|
Founded in 1986, the company has become one of Europe’s leading manufacturers and distributors of hair, beauty, and personal care … |
||||||
| Ransomware | soraris.it id29550 View details | Italy | IT | pending | ||
|
Founded in 1983, the company specializes in the collection, transportation, treatment, and management of municipal solid waste and recyclable materials. … |
||||||
| Ransomware | lcnet.eu id29551 View details | Germany | IT | pending | ||
|
The network was established to provide integrated cross-border transport solutions, allowing member companies to coordinate freight movements efficiently throughout Europe. … |
||||||
| Ransomware | verzolla.com id29552 View details | Italy | Other | pending | ||
|
Founded in 1958 (with the current corporate structure established in 2007), the company specializes in supplying industrial components, automation systems, … |
||||||
| Ransomware | compactmould.com id29553 View details | Canada | Manufacturing / Engineering | leaked | ||
|
Founded in 1978 and headquartered in Woodbridge, Ontario, the company has grown into one of North America’s major suppliers of … |
||||||
| Ransomware | eitecpro.co.jp id29514 View details | Japan | Other | pending | ||
|
Founded in 1988 and headquartered in Osaka, the company operates multiple regional offices across Japan, including Tokyo, Yokohama, Nagoya, Sendai, … |
||||||
| Ransomware | tme-rusta.de id29515 View details | Germany | Manufacturing / Engineering | pending | ||
|
The company was originally founded in Munich in 1966 as an artistic metalworking workshop and later expanded into woodworking, plastics … |
||||||
| Ransomware | cyuou.com id29516 View details | Japan | Communication / Marketing | pending | ||
|
Founded in 2000, the company specializes in website development, digital advertising, graphic design, Wi-Fi infrastructure projects, and online business support … |
||||||
| Ransomware | vdmtrucking.com id29517 View details | Canada | Other | pending | ||
|
Headquartered in Edmonton, Alberta, the company has operated for more than 40 years and has developed into a significant regional … |
||||||
| Ransomware | olipes.com id29276 View details | Spain | Manufacturing / Engineering | pending | ||
|
Founded in 1993 and headquartered in Campo Real, Madrid, the company has become an important independent manufacturer in the European … |
||||||
| Ransomware | harrisoncountywv.com id29229 View details | United States | Other | leaked | ||
|
The Commission functions as the executive administrative body for the county and is responsible for overseeing public infrastructure, fiscal management, … |
||||||
| Ransomware | printroom.co.uk id29230 View details | United Kingdom | Other | pending | ||
|
Founded in 1977, the company has evolved from a small blueprint-printing business into a large multi-service print agency serving corporate, … |
||||||
| Ransomware | hautarzt-budihardja.de id29231 View details | Germany | Healthcare / Pharma | pending | ||
|
The clinic is led by Dr. med. Debby Budihardja, a board-certified dermatologist and allergologist with extensive clinical experience gained at … |
||||||
| Ransomware | mediafrance.de id29232 View details | Germany | Other | pending | ||
|
The company operates primarily in France while maintaining media-related partnerships and activities across European markets, including Germany. Its business model … |
||||||
| Ransomware | ashleytimber.co.uk id29233 View details | United Kingdom | Other | leaked | ||
|
Founded in 1988, the company operates as a family-run SME and has developed a strong regional presence in the North … |
||||||
| Ransomware | adlan.com id29234 View details | Canada | IT | leaked | ||
|
Founded in 1995, the company specializes in IT infrastructure, network design, cybersecurity, disaster recovery, and managed technology services for small … |
||||||
| Ransomware | Berlinmobil.de id29226 View details | Germany | Education | pending | ||
|
Is a German transportation company headquartered in Berlin, specializing in bus charter services, passenger transportation, school transport, and mobility solutions … |
||||||
| Ransomware | smp.cat id28918 View details | Spain | Healthcare / Pharma | pending | ||
|
Is a private healthcare organization based in Catalonia, Spain, operating in the Hospitals & Physicians Clinics sector. Founded in 1993 … |
||||||
| Ransomware | gingerichtrucking.com id28919 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
Is a U.S.-based freight transportation company operating primarily in interstate logistics. The company specializes in hauling general freight, agricultural products … |
||||||
| Ransomware | jmige.com id28920 View details | United States | Communication / Marketing | leaked | ||
|
JMIGE appears to be a company with limited publicly available information, making precise classification difficult. Based on naming conventions and … |
||||||
| Ransomware | id-s.de id28923 View details | Germany | IT | leaked | ||
|
Is a German company operating in the field of digital technologies and IT-related services. Although detailed public information is limited, … |
||||||
| Ransomware | mbk-gmbh.de id28924 View details | Germany | Manufacturing / Engineering | pending | ||
|
Is a German industrial company specializing in metal processing and surface finishing technologies. The company provides services such as galvanizing, … |
||||||
| Ransomware | ettp.be id28925 View details | Belgium | Transportation / Travel / Logistics | leaked | ||
|
Appears to be a Belgian-based entity likely involved in professional training, technology consulting, or industrial services. While detailed public data … |
||||||
| Ransomware | studioubertazzi.it id28926 View details | Italy | Finance / Legal / Insurance | pending | ||
|
Is an Italian firm that likely operates in the field of professional services such as architecture, design, or engineering consulting. … |
||||||
| Ransomware | globalmerchservices.com id28927 View details | United Kingdom | Retail / E-commerce | leaked | ||
|
Global Merchandising Services (GMS) is an international entertainment merchandising company founded in 2008. It specializes in developing and managing merchandise … |
||||||
| Ransomware | soavegel.it id28928 View details | Italy | Agriculture / Food | pending | ||
|
Is an Italian food manufacturing company specializing in frozen gastronomic products. Founded in 1935 in Francavilla Fontana, the company has … |
||||||
| Ransomware | hokuyo2006.co.jp id28867 View details | Japan | Construction / Real Estate | leaked | ||
|
Is a Japanese company that operates as part of a larger industrial group connected to packaging, logistics, and housing-related businesses. … |
||||||
| Ransomware | bootstransport.ca id28868 View details | Canada | Transportation / Travel / Logistics | pending | ||
|
Is a Canadian transportation and logistics company specializing in freight delivery and supply chain services. The company primarily operates in … |
||||||
| Ransomware | dahlgrenscement.se id28869 View details | Sweden | Construction / Real Estate | pending | ||
|
Is a Swedish company operating in the construction materials sector, particularly focused on cement and related building products. Companies in … |
||||||
| Ransomware | maiadouro.pt id28870 View details | Portugal | Manufacturing / Engineering | pending | ||
|
Appears to be a Portuguese company connected to the Douro region, which is internationally known for wine production and agriculture. … |
||||||
| Ransomware | zonaovest.to.it id28871 View details | Italy | Public Sector | pending | ||
|
Is likely an Italian regional organization or consortium based in the Turin (Torino) area. Entities with similar naming conventions in … |
||||||
| Ransomware | fital-treppenlifte.de id28872 View details | Germany | Healthcare / Pharma | leaked | ||
|
Is a German company specializing in stairlifts and mobility solutions for individuals with reduced mobility. The company operates in the … |
||||||
| Ransomware | energyaction.com.au id28333 View details | Australia | Energy | pending | ||
|
Is an energy management and consulting company that helps businesses reduce their energy costs and carbon emissions. Its main services … |
||||||
| Ransomware | hpk.hamburg id28334 View details | Germany | Finance / Legal / Insurance | leaked | ||
|
Is a Hamburg-based, family-run international trading company with over 50 years of experience, specializing in premium meat and seafood imports. … |
||||||
| Ransomware | bbalawgroup.com id28275 View details | United States | Finance / Legal / Insurance | pending | ||
|
Also referred to as BBA Immigration, is a boutique U.S. legal practice headquartered in Houston, Texas, specialising in immigration law … |
||||||
| Ransomware | firstcambodia.com.kh id28274 View details | Cambodia | IT | pending | ||
|
First Cambodia Co., Ltd. is a leading IT services and system integration company headquartered in Phnom Penh, Cambodia. Founded in … |
||||||
| Ransomware | cheeky.com.ar id28273 View details | Argentina | Retail / E-commerce | pending | ||
|
Cheeky is a well-established Argentine children’s fashion brand owned by CHEEK S.A., headquartered in Martínez, Buenos Aires Province. Founded in … |
||||||
| Ransomware | abfall-kreis-kassel.de id28272 View details | Germany | Public Sector | pending | ||
|
The website abfall-kreis-kassel.de represents the Abfallentsorgung Kreis Kassel, a publicly owned waste management entity (Eigenbetrieb) operated by the district of … |
||||||
| Ransomware | genealogysa.org.au id28271 View details | Australia | NGOs / Associations | leaked | ||
|
Genealogy SA, formally known as the South Australian Genealogy & Heraldry Society, is a leading Australian nonprofit organisation dedicated to … |
||||||
| Ransomware | lynxprecast.co.uk id28270 View details | United Kingdom | Manufacturing / Engineering | pending | ||
|
Lynx Precast Ltd is a UK-based construction manufacturing company specialising in the design, manufacture and installation of precast concrete products … |
||||||
| Ransomware | thruwayplumbingservice.com id28269 View details | United States | Services | pending | ||
|
The business provides standard residential and commercial plumbing services, including: - Leak detection and pipe repair - Drain cleaning and … |
||||||
| Ransomware | favellefavco.com id28268 View details | Malaysia | Manufacturing / Engineering | pending | ||
|
Favelle Favco is a leading manufacturer of heavy-duty cranes, including: - tower cranes - offshore cranes - wharf and marine … |
||||||
| Ransomware | st-bernards.bham.sch.uk id28267 View details | United Kingdom | Education | pending | ||
|
St Bernard’s provides primary education for children, including: English, maths, science and general curriculum subjects Religious education (Catholic values are … |
||||||
| Ransomware | academyhealth.org id27937 View details | United States | NGOs / Associations | leaked | ||
|
Is a U.S.-based nonprofit professional organization headquartered in Washington, D.C., dedicated to advancing the fields of health services research and … |
||||||
| Ransomware | brookercg.com id27395 View details | United States | Construction / Real Estate | leaked | ||
|
Is a privately held general contracting and construction management company headquartered in Chattanooga, Tennessee, United States. The firm specializes in … |
||||||
| Ransomware | tiefenbachergroup.com id27394 View details | Germany | Healthcare / Pharma | pending | ||
|
Is a 100% family-owned, leading global healthcare company founded in 1963 and based in Hamburg, Germany. The company operates across … |
||||||
| Ransomware | briwaycarriers.com id27393 View details | Canada | Agriculture / Food | pending | ||
|
Ontario-based transportation company specializing in specialized freight, including a dedicated glass division and agricultural services. They offer global supply chain … |
||||||
| Ransomware | mattandsteve.com id27392 View details | Canada | Manufacturing / Engineering | pending | ||
|
Is a Canadian food manufacturer based in Mississauga, Ontario, founded in 2000 by Matthew Larochelle and Steve McVicker. Known for … |
||||||
| Ransomware | thenavigatorcompany.com id27391 View details | Portugal | Manufacturing / Engineering | pending | ||
|
Is a major Portuguese producer of forestry, pulp, paper, tissue, and sustainable packaging solutions, recognized as Europe's largest manufacturer of … |
||||||
| Ransomware | smileteam.com.au id27140 View details | Australia | Healthcare / Pharma | pending | ||
|
Is a privately owned Australian healthcare company specialising in orthodontic treatment and dental alignment services. The organisation was founded around … |
||||||
| Ransomware | ripobec.com id27037 View details | Canada | Agriculture / Food | pending | ||
|
Is a Canadian family-owned agricultural supply company headquartered in Saint-Apollinaire, Quebec, specialising in the production and distribution of premium wood … |
||||||
| Ransomware | Franz-Sales-Haus.de id27033 View details | Germany | Retail / E-commerce | pending | ||
|
Located at Steeler Straße 261, 45138 Essen, is a support organization dedicated to empowering people with disabilities to live self-determined … |
||||||
| Ransomware | atadler.com.sg id26366 View details | Singapore | Finance / Legal / Insurance | leaked | ||
|
Is a Singapore-based accounting, auditing and bookkeeping services firm that has been operating as a registered partnership since 25 October … |
||||||
| Ransomware | kres.cz id26365 View details | Czechia | Retail / E-commerce | pending | ||
|
Czech small-to-medium enterprise headquartered in Krnov – Pod Cvilínem, Czech Republic. The company specialises in the sale, repair and servicing … |
||||||
| Ransomware | groupepiche.ca id26364 View details | Canada | Construction / Real Estate | leaked | ||
|
Is a privately held Canadian construction and interior systems company headquartered in Ferme-Neuve, Québec with additional offices in Boisbriand (QC), … |
||||||
| Ransomware | freidarothman.com id25835 View details | United States | Other | leaked | ||
|
Based jewelry and accessories brand founded and led by designer Freida Rothman, who grew up in Brooklyn and comes from … |
||||||
| Ransomware | gsglobalresources.com id25753 View details | United States | Manufacturing / Engineering | pending | ||
|
GS Global Resources (often abbreviated GSGR) is an American industrial engineering and machine-performance solutions company headquartered in Mukwonago, Wisconsin. Founded … |
||||||
| Ransomware | lcpublishinggroup.com id25752 View details | Italy | Services | pending | ||
|
LC Publishing Group S.p.A. is an international digital publishing and information services company headquartered in Milan, Italy. Founded in 2011, … |
||||||
| Ransomware | adifse.com.ar id25751 View details | Argentina | Retail / E-commerce | pending | ||
|
ADIFSE — formally the Administración de Infraestructuras Ferroviarias Sociedad del Estado — is a state-owned railway infrastructure company in Argentina … |
||||||
| Ransomware | trulinemfg.com id25750 View details | United States | Manufacturing / Engineering | pending | ||
|
Tru-Line Manufacturing Company is an American industrial fabrication firm headquartered in Decatur, Alabama that specialises in the metal fabrication of … |
||||||
| Ransomware | superiordrywall.com id25749 View details | United States | Other | pending | ||
|
Superior Drywall is an established American commercial drywall contracting company based in Oxnard, California, specialising in a range of interior … |
||||||
| Ransomware | interr.com id25748 View details | United Kingdom | Services | leaked | ||
|
Interr is a privately held security and risk-management services company headquartered at The Loom, 14 Gower’s Walk, London, UK. Established … |
||||||
| Ransomware | rlc.es id25730 View details | Spain | Transportation / Travel / Logistics | pending | ||
|
RLC Transportes (operating under Rau Load Cargo, S.L.) is a Spanish logistics and freight-transport company based in El Puig de … |
||||||
| Ransomware | abcseamless.com id25607 View details | United States | Manufacturing / Engineering | pending | ||
|
ABC Seamless is a U.S.-based home improvement and exterior construction company that specialises in custom on-site manufactured seamless steel siding, … |
||||||
| Ransomware | wohnverbund-st-gertrud.de id25606 View details | Germany | Services | pending | ||
|
Wohnverbund St. Gertrud is a German social care and residential support organisation located in Morsbach, North Rhine-Westphalia, Germany. It operates … |
||||||
| Ransomware | ipu.co.il id25605 View details | Israel | Manufacturing / Engineering | leaked | ||
|
IPU Industries Ltd. is a privately held Israeli industrial manufacturing company headquartered in Kiryat Gat, Israel, specialising in advanced plastic … |
||||||
| Ransomware | setex-textil.de id25217 View details | Germany | Communication / Marketing | pending | ||
|
SETEX-Textil GmbH is a vertically integrated German textile manufacturer headquartered in Hamminkeln-Dingden, North Rhine-Westphalia. The company operates comprehensive textile production … |
||||||
| Ransomware | davidrosenbakerysupply.com id25216 View details | United States | Other | pending | ||
|
David Rosen Bakery Supply is a long-established wholesale bakery supply and distribution company headquartered in Maspeth, New York, serving commercial … |
||||||
| Ransomware | knightgroup.co.uk id25215 View details | United Kingdom | Communication / Marketing | pending | ||
|
Knight Group is a UK-based precision metal stockist and processor with a long history dating back to 1943. The company … |
||||||
| Ransomware | moorelumber.com id25214 View details | United States | Retail / E-commerce | pending | ||
|
Moore Lumber & Hardware Co. is a U.S. building-materials retailer and hardware supplier based in Ayer, Massachusetts. Founded in the … |
||||||
| Ransomware | usdaw.org.uk id25213 View details | United Kingdom | Retail / E-commerce | pending | ||
|
Usdaw — formally the Union of Shop, Distributive and Allied Workers — is one of the United Kingdom’s largest and … |
||||||
| Ransomware | investigacionesmedicas.com id25212 View details | Argentina | Communication / Marketing | leaked | ||
|
Investigaciones Médicas is a private medical diagnostics and imaging services provider based in Buenos Aires, Argentina. Founded in 1991, it … |
||||||
| Ransomware | sproutnet.com id25211 View details | United States | Communication / Marketing | pending | ||
|
SproutNet — operating under International Specialty Supply — is a U.S. producer and supplier of sprouting seeds, sprouts, natural ingredients … |
||||||
| Ransomware | precisionaluminum.ca id25210 View details | Canada | Communication / Marketing | pending | ||
|
Precision Aluminum Manufacturing Inc. is a Canadian metal fabrication and architectural products company headquartered in Rocky View County (near Calgary), … |
||||||
| Ransomware | estrumar.es id25209 View details | Spain | Manufacturing / Engineering | leaked | ||
|
Metálicas Estrumar is a Spanish metal fabrication and structural engineering company headquartered in Burgos, Castilla y León, Spain. It is … |
||||||
| Ransomware | pau.at id25188 View details | Austria | Communication / Marketing | pending | ||
|
PAUAT Architekten is a regional architectural practice based in Wels, Austria, founded in 1999 and led by architect Heinz Plöderl. … |
||||||
| Ransomware | heatcel.co.uk id25171 View details | United Kingdom | Manufacturing / Engineering | leaked | ||
|
Heatcel is a UK-based specialist supplier of central heating spares, components and equipment, operating as a stockist and distributor for … |
||||||
| Ransomware | ryc.org id25170 View details | United States | Communication / Marketing | pending | ||
|
Raritan Yacht Club (RYC) is a private, member-owned recreational club located in Perth Amboy, New Jersey, with a history dating … |
||||||
| Ransomware | studioelad.it id25169 View details | Italy | Services | pending | ||
|
Studio Elad — legally registered as Elad S.r.l. — is an Italian company operating in the professional services and business … |
||||||
| Ransomware | debralmorrison.com id25168 View details | United States | Communication / Marketing | leaked | ||
|
Debra L. Morrison operates a professional coaching, speaking, and financial education practice associated with the domain DebraLMorrison.com, which serves as … |
||||||
| Ransomware | hmpccpa.com id25167 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Harvey & Martin, PLLC is a professional accounting firm based in Massachusetts, United States, with additional offices in Gloucester, MA … |
||||||
| Ransomware | vanvenrooy.com id25166 View details | Netherlands | Manufacturing / Engineering | pending | ||
|
Van Venrooy is a Dutch family-owned engineering and manufacturing company based in Oss, the Netherlands, that specialises in tailor-made utility … |
||||||
| Ransomware | wadzeck-stiftung.de id25165 View details | Germany | Other | pending | ||
|
Wadzeck-Stiftung is one of Germany’s oldest charitable youth-welfare organisations, founded in 1819 in Berlin as the first evangelical orphanage in … |
||||||
| Ransomware | inpipeproducts.com id25164 View details | United Kingdom | Communication / Marketing | leaked | ||
|
iNPIPE PRODUCTS is a British engineering and manufacturing company headquartered in Brompton on Swale, North Yorkshire, United Kingdom. The firm … |
||||||
| Ransomware | larosadelmonte.com id25163 View details | United States | Transportation / Travel / Logistics | pending | ||
|
La Rosa Del Monte is a long-standing family-owned moving and logistics company based in Bronx, New York, with operations extending … |
||||||
| Ransomware | polhun.pl id25081 View details | Poland | Manufacturing / Engineering | pending | ||
|
POL-HUN is a well-established Polish manufacturer and distributor of household cleaning products and consumer chemicals. Founded in 1990, the company … |
||||||
| Ransomware | maxdream.tur.ar id25080 View details | Argentina | Transportation / Travel / Logistics | pending | ||
|
Maxdream is an Argentine travel and tourism company headquartered in Buenos Aires, Argentina, that specialises in organising student travel experiences … |
||||||
| Ransomware | 47club.jp id25079 View details | Japan | Retail / E-commerce | leaked | ||
|
47CLUB (operated by Kabushiki Kaisha 47CLUB, or 株式会社47CLUB) is a Japanese e-commerce and regional marketing company based in Tokyo. Its … |
||||||
| Ransomware | nhpsa.com.ar id25078 View details | Argentina | Retail / E-commerce | pending | ||
|
NHPSA — formally New High Pack S.A. — is an Argentine packaging manufacturer and supplier based in Benavídez, Tigre, Province … |
||||||
| Ransomware | vitatrac.com.gt id25077 View details | Guatemala | Manufacturing / Engineering | pending | ||
|
Vitatrac S.A. is a long-established automotive service and tire distribution company headquartered in Guatemala City, Guatemala, with multiple service centers … |
||||||
| Ransomware | eiconnect.com id25076 View details | United States | Communication / Marketing | leaked | ||
|
Electronic Interconnect, often referred to as EI, is a U.S.-based manufacturer and supplier of printed circuit boards (PCBs) headquartered in … |
||||||
| Ransomware | massfd.org id25075 View details | United States | Other | pending | ||
|
MassFD — as reflected by the domain massfd.org — appears to be the official website of the Massapequa Fire District, … |
||||||
| Ransomware | cmac-llc.com id25073 View details | United States | Retail / E-commerce | pending | ||
|
cMAC LLC is a small, privately-held construction and general contracting firm based in Renton, Washington, serving residential and commercial clients … |
||||||
| Ransomware | envases-group.com id25072 View details | United Kingdom | Communication / Marketing | leaked | ||
|
Envases Group is a privately held multinational packaging manufacturer and solutions provider with deep roots in the global containers and … |
||||||