We've just wrapped up the new design, along with a ton of other improvements. Check them all out in the Changelog.

Ransomware Group intelligence

Safepay

Active

Track Safepay with 595 published victims and 5 known leak locations in a single intelligence view.

DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 595 Known published victims in this dataset
First discovered 2024-11-19 Earliest victim discovery date
Last discovered 2026-10-12 Latest victim discovery date
Inactive since 19 days Days since the latest known victim
Top country United States 217 victims
Known locations 5 Leak or negotiation infrastructure tracked

Overview

Safepay is tracked by Dark Eye as a ransomware group with 595 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

Leak Status Distribution

  • Leaked 153 25.7%
  • Pending 440 73.9%
  • Deleted 2 0.3%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (5)

    Label Type Availability Links
    Leak location 5 Onion service Up checked 25m ago safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion
    Leak location 2 Onion service Down checked 25m ago cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion
    Leak location 4 Onion service Down checked 26m ago j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion
    Leak location 3 Onion service Down checked 26m ago nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion
    Leak location 1 Onion service Down checked 26m ago nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

    Top Activity Sectors (17)

    Victims (595)

    Search, filter and paginate the victim timeline for Safepay. Showing 301–400 of 595.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware decor-metall.de id21999 View details Germany Manufacturing / Engineering leaked
    Ransomware akd-ekbo.de id21950 View details Germany Education leaked
    Ransomware jphrs-waghaeusel.de id21949 View details Germany Education leaked
    Ransomware parksidegroup.co.uk id21948 View details United Kingdom Communication / Marketing leaked
    Ransomware ferienwohnungen.de id21947 View details Germany Transportation / Travel / Logistics leaked
    Ransomware phillips66lubricants.com id21946 View details United States Manufacturing / Engineering leaked
    Ransomware faltner.de id21945 View details Germany Agriculture / Food leaked
    Ransomware optivosa.com id21944 View details Mexico Communication / Marketing leaked
    Ransomware rivertoncabinets.com id21943 View details United States Other leaked
    Ransomware schliessmeyer.de id21942 View details Germany Manufacturing / Engineering leaked
    Ransomware childrenscouncil.org id21837 View details United States Public Sector leaked
    Ransomware albertaindustrialcontrols.com id21826 View details Canada Manufacturing / Engineering leaked
    Ransomware listgrove.com id21825 View details United Kingdom Other pending
    Ransomware transelectric.co.il id21824 View details Israel Manufacturing / Engineering leaked
    Ransomware batemangroundworks.co.uk id21823 View details United Kingdom Manufacturing / Engineering leaked
    Ransomware godbyhearth.com id21822 View details United States Communication / Marketing leaked
    Ransomware mauilodging.com id21628 View details United States Communication / Marketing pending
    Ransomware ridgefield.org id21539 View details United States Education pending
    Ransomware chamberlainhuckeriede.com id21492 View details United States Services pending
    Ransomware ingrammicro.com id21420 View details United States IT pending
    Ransomware tele-optics.com id21390 View details United States Other pending
    Ransomware appsnw.com id21389 View details United States Other pending
    Ransomware wta-inc.com id21388 View details United States Transportation / Travel / Logistics pending
    Ransomware bussepc.com id21387 View details Germany Other pending
    Ransomware swfldermatology.com id21386 View details United States Healthcare / Pharma pending
    Ransomware havtechpa.com id21385 View details United States IT pending
    Ransomware appagroup.com id21384 View details Germany Construction / Real Estate pending
    Ransomware briar-group.com id21383 View details United States Hospitality / Food & Beverage / Tourism pending
    Ransomware teamsignal.com id21382 View details United States Communication / Marketing pending
    Ransomware blueridgesl.com id21325 View details United States Other pending
    Ransomware rhschool.org id21324 View details United States Education pending
    Ransomware qtmi.net id21323 View details United States Other pending
    Ransomware horanbarker.com id21322 View details United States Hospitality / Food & Beverage / Tourism pending
    Ransomware naxis.net id21321 View details Japan Other pending
    Ransomware landwwilson.co.uk id21320 View details United Kingdom Other pending
    Ransomware salemma.com.py id21319 View details Paraguay Other pending
    Ransomware stichtingjohannesbosco.com id21318 View details Netherlands Other pending
    Ransomware bisa.com.pe id21317 View details Peru Services pending
    Ransomware norpak.com id21239 View details Canada Communication / Marketing pending
    Ransomware ashland.k12.ma.us id21206 View details United States Other pending
    Ransomware divgroup.eu id21205 View details Slovakia Services pending
    Ransomware hlb.ie id21204 View details Ireland Other pending
    Ransomware palmasdelixcan.com id21203 View details Mexico Other pending
    Ransomware accademia.it id21202 View details Italy Other pending
    Ransomware nod.ro id21120 View details Romania Other pending
    Ransomware bartec.com id21119 View details Germany IT pending
    Ransomware silverdalebc.com id21043 View details United States Other pending
    Ransomware chirurgiemaxillo.com id21042 View details Canada Other pending
    Ransomware lowcostspayneuterindiana.org id21041 View details United States Communication / Marketing pending
    Ransomware avgouleaschool.gr id21040 View details Greece Education pending
    Ransomware lewis-manning.org.uk id21039 View details United Kingdom Other pending
    Ransomware wmat.nsn.us id21038 View details United States Other pending
    Ransomware cascobay.org id21037 View details United States Communication / Marketing pending
    Ransomware profile-ind.com id21036 View details United States Communication / Marketing pending
    Ransomware relucent.com id21035 View details United States Other pending
    Ransomware fmsarchitects.com id21034 View details United States Construction / Real Estate pending
    Ransomware ppa-eng.com.org id21033 View details — Other pending
    Ransomware caredig.co.uk id21032 View details United Kingdom Other pending
    Ransomware dossenterprises.com id20928 View details United States Communication / Marketing pending
    Ransomware lafayettefamilyymca.org id20927 View details United States Communication / Marketing pending
    Ransomware jansen-aschendorf.de id20926 View details Germany Other pending
    Ransomware tdunhamcpa.com id20809 View details United States Communication / Marketing pending
    Ransomware mccn.org id20783 View details United States Other pending
    Ransomware mlderm.com id20781 View details United States Communication / Marketing pending
    Ransomware membersourcecu.org id20715 View details United States Finance / Legal / Insurance pending
    Ransomware macedonia.oh.us id20708 View details United States Other pending
    Ransomware codesco.com id20665 View details Germany IT pending
    Ransomware packagesteel.com id20664 View details United States Manufacturing / Engineering pending
    Ransomware hohmannoilandplumbing.com id20662 View details United States Energy pending
    Ransomware cs-groupllc.com id20661 View details United States Services pending
    Ransomware pzsarchitects.com id20660 View details Finland Healthcare / Pharma pending
    Ransomware welcometosedgebrook.com id20659 View details United States Other pending
    Ransomware moffett-towers-club.com id20658 View details United States Other pending
    Ransomware liberty-township.com id20657 View details United States Other pending
    Ransomware mcsl.de id20656 View details Germany Other pending
    Ransomware rusindustries.com id20655 View details Russian Federation Other pending
    Ransomware theoverheaddoorco.com id20654 View details United States Communication / Marketing pending
    Ransomware awo-giessen.org id20653 View details Germany Other pending
    Ransomware realschule-karlstadt.org id20652 View details Germany Other pending
    Ransomware bristolhose.com id20651 View details United States Manufacturing / Engineering pending
    Ransomware ramlaw.com id20640 View details United States Finance / Legal / Insurance pending
    Ransomware electro-seal.com id20545 View details United States Services pending
    Ransomware mytaac.com id20530 View details United States Other pending
    Ransomware mercercapital.com id20529 View details United States Services pending
    Ransomware triangleheatingcooling.com id20528 View details United States Communication / Marketing pending
    Ransomware Myer Auto id20420 View details Australia Other pending
    Ransomware ochsinc.org.com id20419 View details United States Services pending
    Ransomware digitalwarroom.com id20418 View details United States IT pending
    Ransomware universityacademy.org id20374 View details United States Education pending
    Ransomware meeksgroup.com id20359 View details United States Communication / Marketing pending
    Ransomware sfhumanesociety.org id20358 View details United States NGOs / Associations pending
    Ransomware donowentire.com id20357 View details United States Communication / Marketing pending
    Ransomware iicil.com id20356 View details United States Other pending
    Ransomware visco.de id20355 View details Germany Communication / Marketing pending
    Ransomware buechel-online.com id20354 View details Germany Other pending
    Ransomware ibague.losolivos.co id20335 View details Colombia Communication / Marketing pending
    Ransomware Avance Agricola sl id20334 View details Spain Agriculture / Food pending
    Ransomware murraybuildingcompany.com id20333 View details United States Construction / Real Estate pending
    Ransomware sander-doll.com id20332 View details Germany Other pending
    Ransomware usmortgage.com id20331 View details United States Communication / Marketing pending