Ransomware Group intelligence

Safepay

Active

Track Safepay with 595 published victims and 5 known leak locations in a single intelligence view.

DARK EYE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 595 Known published victims in this dataset

First discovered 2024-11-19 Earliest victim discovery date

Last discovered 2026-10-12 Latest victim discovery date

Inactive since 19 days Days since the latest known victim

Top country United States 217 victims

Known locations 5 Leak or negotiation infrastructure tracked

Safepay is tracked by Dark Eye as a ransomware group with 595 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

595

Leaked 153 25.7%
Pending 440 73.9%
Deleted 2 0.3%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 5	Onion service	Up checked 25m ago	`safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion`
Leak location 2	Onion service	Down checked 25m ago	`cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion`
Leak location 4	Onion service	Down checked 26m ago	`j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion`
Leak location 3	Onion service	Down checked 26m ago	`nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion`
Leak location 1	Onion service	Down checked 26m ago	`nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion`

Not identified 146
Communication / Marketing 94
Manufacturing / Engineering 60
Services 43
IT 36
Construction / Real Estate 31
Healthcare / Pharma 29
Finance / Legal / Insurance 27
Retail / E-commerce 25
Education 25
Agriculture / Food 17
Public Sector 14
Transportation / Travel / Logistics 14
Hospitality / Food & Beverage / Tourism 13
NGOs / Associations 10
Energy 4
null 1

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1688 Safe Mode Boot Defense Impairment

What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.

What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
T1027.016 Junk Code Insertion Stealth

What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.

What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
T1070.004 File Deletion Stealth

What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1135 Network Share Discovery Discovery

What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1491.001 Internal Defacement Impact

What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Tools Observed (8)

▼

Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery

Invoke-ShareFinder

Exfiltration

FileZilla 7zip WinRAR

LOLBAS (living-off-the-land binaries)

Regsvr32.exe CMSTPLUA dllhost.exe

RMM Tools

Microsoft RDP

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.

Ransom Notes (2)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

readme_safepay.txt txt · 3019 chars

Greetings! Your corporate network was attacked by SafePay team.

Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.

It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.

We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.

Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.

Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.

We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM.

In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.

In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

Install and run Tor Browser from https://www.torproject.org/download/

Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion

Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion

Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

Our blog:

http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion

http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

Our TON blog:

tonsite://safepay.ton

You can connect through your Telegramm account.

View on RansomLook

readme_safepay_ascii.txt txt · 2999 chars

Greetings! Your corporate network was attacked by SafePay team.
Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.
It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.
We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.
Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.
Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.
We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM.
In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.
In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

Install and run Tor Browser from https://www.torproject.org/download/

Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion

Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion

Log in with ID: [snip]
Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

Our blog:

http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion

http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

Our TON blog:
tonsite://safepay.ton

You can connect through your Telegramm account.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (595)

Search, filter and paginate the victim timeline for Safepay. Showing 501–595 of 595.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	wagner-transporte.com id18808 View details	2025-03-30	Germany	Transportation / Travel / Logistics		pending
[AI generated] N/A ID 18808
Ransomware	children-ne.org.uk id18807 View details	2025-03-30	United Kingdom	Other		pending
[AI generated] N/A ID 18807
Ransomware	mayaassurance.com id18806 View details	2025-03-30	United States	Communication / Marketing		pending
[AI generated] Maya Assurance Company is a New York-based insurance firm that specializes in auto insurance. It serves customers predominately in the local areas, providing a wide range of coverages including liability, collision, comprehensive, uninsured motorist, and personal injury protection. Maya Assurance Company distinguishes itself by offering personalized services and affordable rates. ID 18806
Ransomware	saiedu.fi id18709 View details	2025-03-25	Finland	Education		pending
[AI generated] Saiedu.fi, known as SAI Education and Development Finland, is a Finland-based company that aims to support education and development globally. This organization works to improve school systems, teachers' professional development, and curriculum design. SAI offers a range of services, from training courses and seminars to consultancy services in education and development. ID 18709
Ransomware	compassionhealthcare.org id18600 View details	2025-03-22	—	Healthcare / Pharma		pending
[AI generated] N/A ID 18600
Ransomware	terrell.k12.ga.us id18472 View details	2025-03-17	United States	Other		pending
[AI generated] N/A ID 18472
Ransomware	argusdatainsights.de id18423 View details	2025-03-14	Germany	Communication / Marketing		pending
[AI generated] Argus Data Insights is a German company that specializes in media monitoring and analysis. They provide businesses with important insights and intelligence on their media presence and public perception. Their services include tracking, documenting, and analyzing traditional and digital media to help clients make informed decisions. Argus Data Insights combines technology with experienced media experts to deliver comprehensive media intelligence. ID 18423
Ransomware	tradingacademy.com id18344 View details	2025-03-11	United States	Education		pending
[AI generated] Trading Academy is a financial education provider that offers online and in-person courses for individuals interested in learning about trading and investing. They provide education in fields such as stocks, Forex, futures, and options. Their courses cater to beginners as well as seasoned investors, and they are known for their interactive learning experience and hands-on training methods. ID 18344
Ransomware	ultimateclasslimo.com id18343 View details	2025-03-11	United States	Communication / Marketing		pending
[AI generated] Ultimate Class Limo is a professional transportation company based in New York. It offers a wide collection of luxury vehicles like limousines, buses, vans, SUVs and cars for various events. Its services range from corporate transport and airport transfers to special events like weddings, proms, and tours. With professionally trained drivers and quality service, it prioritises comfort and safety. It also provides customised travel solutions based on clients' individual needs. ID 18343
Ransomware	havenresorts.com id18342 View details	2025-03-11	Mexico	Hospitality / Food & Beverage / Tourism		pending
Enjoy sanctuary of luxury and sophistication at Haven Riviera Cancun, an adults-only, all-inclusive resort located between Cancun & Riviera Maya. ID 18342
Ransomware	lgipr.com id18341 View details	2025-03-11	United States	Communication / Marketing		pending
[AI generated] LGIPR.com appears to be a Russian company that offers various services in the field of intellectual property rights. These services may include patent registration, trademarks, copyright, license agreements, assessment of intellectual property, and more. However, due to limited information available online and possible language barriers, specifics about the company can be scarce. ID 18341
Ransomware	jockeysalud.com.pe id18340 View details	2025-03-11	Peru	Healthcare / Pharma		pending
[AI generated] "Jockeysalud.com.pe" is a healthcare institution based in Lima, Peru. They are committed to providing the highest quality of health service to the public. Their main wings include specialized healthcare, preventive medicine, medical examination, nursing services, and emergency care. They are highly equipped with cutting-edge medical technology and professional medical staff to enhance their service standards. ID 18340
Ransomware	motomecanica.com id18339 View details	2025-03-11	Spain	Communication / Marketing		pending
[AI generated] Motomecanica.com is renowned for its expertise in the production and supply of high-quality main propulsion equipment and deck machinery for ships. The company's rigorous quality checks, innovative designing, and manufacturing ensure its products are reliable and efficient. They serve a diverse client base worldwide, including naval markets. Their product range includes gearboxes, winches, hydraulic systems, and more. ID 18339
Ransomware	cali.losolivos.co id18338 View details	2025-03-11	Colombia	Communication / Marketing		pending
[AI generated] I'm sorry, but there doesn't seem to be enough verifiable or specific information available about a company by the name "cali.losolivos.co". It's possible that you may be referring to "Los Olivos", which is a well-known funeral services company in Colombia. However, without more specific details, it's difficult to provide a thorough description. Please provide more information. ID 18338
Ransomware	willms-fleisch.de id18188 View details	2025-03-05	Germany	Communication / Marketing		pending
[AI generated] Willms-Fleisch GmbH is a Germany-based company known for providing high quality meat products. The company specializes in the import and export, processing, and sales of high-quality pork, beef, and other meat products. Their expertise includes individual cuts for various culinary requirements, and special meat products for industrial users. They boast more than 50 years in the industry, signaling a strong reputation for both domestic and international customers. ID 18188
Ransomware	plasseramerican.com id18101 View details	2025-02-28	United States	Manufacturing / Engineering		pending
[AI generated] Plasser American Corporation is an eminent manufacturer of heavy machinery and equipment designed for maintenance of way (MOW) on railroads. They offer an extensive range of advanced machines and systems such as track laying machines, tampers, stabilizers, ballast distributing and profiling machinery, and other track maintenance equipment. The company is known for their high-quality products that significantly increase the life-cycle of rail tracks. ID 18101
Ransomware	conduent.com id17679 View details	2025-02-20	United States	Services		pending
[AI generated] Conduent is a global company specializing in business process services. They provide digital platforms and services for both businesses and governments. Conduent's expertise covers sectors like healthcare, transportation, and financial services among others. Their services aim to improve user experiences, boost operational efficiency and increase client satisfaction. They were formerly a part of Xerox. ID 17679
Ransomware	ziese.net id17648 View details	2025-02-19	Germany	Communication / Marketing		pending
Ziese & Sons Excavating, Inc. is your premier excavation company serving Crown Point and the surrounding areas. Contact us today for a free consultation. ID 17648
Ransomware	rwrhine.com id17647 View details	2025-02-19	United States	Communication / Marketing		pending
[AI generated] Rwrhine.com is a professional dental practice led by Dr. Richard W. Rhine, a reputed dentist renowned for his expertise in general and cosmetic dentistry. The practice is located in Hayward, California, and is dedicated to offering personalized service and comprehensive dental care. The company's services ranges from preventive care and routine cleanings to restorative procedures and cosmetic treatments. ID 17647
Ransomware	foyernotredamedepaix.be id17646 View details	2025-02-19	Belgium	Healthcare / Pharma		pending
[AI generated] Foyernotredamedepaix.be is a Belgian healthcare company that specializes in treating people with mental illnesses and disabilities. The company provides personalized care plans focusing on respect, autonomy, and personal development while preserving patients' dignity. They offer aid to families affected by such illnesses and aim to create a peaceful, supportive environment for each individual under their care. ID 17646
Ransomware	fastrans.com id17645 View details	2025-02-19	United States	Transportation / Travel / Logistics		pending
Fastrans Logistics ID 17645
Ransomware	stjerome.org id17496 View details	2025-02-12	United States	Education		pending
[AI generated] Stjerome.org appears to be a non-existent or unrecognized company. The name "St Jerome" is often associated with religious institutions, specifically Roman Catholic churches or schools, as St. Jerome is recognized as a saint in the Catholic faith. Without additional information or a functioning website, it's challenging to provide an accurate description of the entity referenced by "stjerome.org". ID 17496
Ransomware	harcoboe.net id17256 View details	2025-02-06	Denmark	Communication / Marketing		pending
[AI generated] "Harcoboe.net" is a webmail service provided by Harrison County Board of Education in the United States. This platform enables seamless communication within their education system, primarily used by staff members for professional electronic communication. They offer a secure, efficient and user-friendly email system improving operational efficiency within the Harrison County Schools. ID 17256
Ransomware	lowernazareth.com id17255 View details	2025-02-06	United States	Communication / Marketing		pending
[AI generated] "lowernazareth.com" appears to be a community-focused site serving the residents of Lower Nazareth, a township in Pennsylvania. The company offers local information, news, events, community updates and resources. It may also play a role in promoting local businesses and supporting community engagement. However, precise details of the company could not be found, which suggests it might not be widely recognized or could be newly established. ID 17255
Ransomware	www.iecsolutions.com id17240 View details	2025-02-05	United States	Services		pending
[AI generated] IEC Solutions is a telecommunication company specializing in designing, installing, and maintaining complex fiber-optic and copper communication networks. They offer a wide array of services including network design, project management, cable installation and upgrading, and communication room build-outs. Their clientele spans across both the public and private sectors. The company is committed to quality, safety and harnessing the latest technology. ID 17240
Ransomware	brewsterfiredepartment.org id17153 View details	2025-02-03	United States	Public Sector		pending
[AI generated] "Brewster Fire Department" appears to be a fire and emergency service provider based in Brewster, likely in the United States. As a fire department, they are likely responsible for providing rapid, professional response to fires, medical emergencies, and other incidents that threaten public safety. They may also offer public educational programs focused on fire safety, emergency preparedness, and related topics. Note that more specific information may vary by location. ID 17153
Ransomware	derrimon.com id17152 View details	2025-02-03	Jamaica	Communication / Marketing		pending
[AI generated] Derrimon Trading Company Limited is a Jamaican-based firm engaged in the distribution and trading of a wide array of product categories from food items to personal care. The company has also ventured into retail with the acquisition of Sampars Cash and Carry, and operates numerous supermarkets throughout Jamaica. Derrimon aims to consistently provide its customers with high quality products while prioritizing sustainable growth. ID 17152
Ransomware	globexusa.com id17151 View details	2025-02-03	United States	Services		pending
[AI generated] GlobexUSA is a company that specializes in cross-border e-commerce solutions, helping businesses expand their reach globally. It offers services such as international logistics, web development, and online marketing. They also provide services to help businesses deal with aspects like taxation, regulatory compliance, customs and international payments. It is a versatile solution for businesses aiming to extend their operations internationally. ID 17151
Ransomware	muscogee.k12.ga.us id16960 View details	2025-01-28	United States	Education		pending
[AI generated] Muscogee.k12.ga.us is the official web portal for the Muscogee County School District, located in Georgia, USA. They aim to inspire and equip all students to achieve unlimited potential. The website provides resources including information about schools in the district, educational programs, staff contacts, calendar events, and various student and parent services. ID 16960
Ransomware	bigotti.ro id16862 View details	2025-01-25	Romania	Communication / Marketing		pending
[AI generated] Bigotti.ro is a Romania-based fashion company specializing in men's clothing and accessories. Known for its high-quality Italian design, the brand offers a wide selection of items such as suits, shirts, shoes, and ties. They focus on providing stylish, yet comfortable apparel that suits both formal and casual occasions. Customer service and satisfaction are at the core of their values. ID 16862
Ransomware	mcpathology.com id16861 View details	2025-01-25	Australia	Healthcare / Pharma		pending
[AI generated] McPathology.com is essentially a Brisbane-based medical diagnostic service and laboratory that provides a wide range of pathology testing services. It is fully accredited by the Royal College of Pathologists of Australia. Professional pathologists, doctors, and health professionals rely on it to deliver accurate results with the aim of diagnosing, treating, and monitoring diseases and health conditions more effectively. ID 16861
Ransomware	nutripack.eu id16860 View details	2025-01-25	France	Agriculture / Food		pending
[AI generated] Nutripack.eu is a prominent international company based in Europe that specializes in the manufacturing and sales of sustainable food packaging. The company offers innovative, eco-friendly solutions for food packaging, ranging from recyclable trays to bio-degradable options. Established with the goal of reducing plastic wastage, Nutripack's strategic commitment revolves around environmental responsibility and creativity. They cater to various sectors including catering, agri-food industries, and healthcare. ID 16860
Ransomware	paradiseschools.org id16859 View details	2025-01-25	United States	Education		pending
[AI generated] Paradise Schools is a network of K-12 charter schools located in Surprise, Arizona. The organization, established in 1997, comprises three schools - Paradise Honors High School, Paradise Honors Middle School, and Paradise Education Center. It offers a comprehensive curriculum aligned with state and national standards. The student-centric institution strives to cultivate creativity, critical thinking, leadership, and character development in a safe and inclusive environment. ID 16859
Ransomware	welcomewagon.com id16858 View details	2025-01-25	United States	Services		pending
[AI generated] Welcome Wagon is a US-based company focused on creating connections between new homeowners, movers and local businesses. They specialize in welcoming new residents to their community, introducing them to products and services of local businesses through direct mail marketing, digital marketing services, and gift books. They aim to stimulate local economic growth by fostering these new relationships. ID 16858
Ransomware	cellsciencesystems.com id16857 View details	2025-01-25	United States	Healthcare / Pharma		pending
[AI generated] Cell Science Systems is a specialty clinical laboratory that develops and performs laboratory testing in immunology and cell biology to assist healthcare providers in the diagnosis, treatment, and monitoring of complex disorders. The company is notable for pioneering the Alcat Test for food and chemical sensitivities. The tests support the personalized treatment plans for conditions like digestion issues, migraines, obesity, chronic fatigue, aching joints, skin disorders, etc. ID 16857
Ransomware	BBBIND.COM id16771 View details	2025-01-23	United States	Communication / Marketing		pending
[AI generated] BBBIND.COM is a leading American company specialized in automotive aftermarket parts. It sells premium parts, particularly offering high-quality rotating electrical products. The company’s product portfolio includes alternators, starters, brake calipers, power steering products, etc. They also provide their customers with technical diagnostic support and information to ensure the correct product usage. ID 16771
Ransomware	gaylord.org id16767 View details	2025-01-22	—	Other		pending
No additional victim description available. ID 16767
Ransomware	semesco.com id16752 View details	2025-01-21	Cyprus	Retail / E-commerce		pending
[AI generated] Semesco.com is an e-commerce platform that allows users to buy and sell a variety of products across different categories. These include electronics, clothing, beauty products, household items, and more. It also facilitates secure online transactions and provides delivery services to customers. Moreover, Semesco supports local brands and businesses by helping them reach a wider customer base. They focus on providing an enhanced shopping experience with a user-friendly website and customer service. ID 16752
Ransomware	brunetti.com id16751 View details	2025-01-21	Australia	Hospitality / Food & Beverage / Tourism		pending
[AI generated] Brunetti is a renowned Italian cafe established in Melbourne, Australia in 1985. Known for its European ambiance and authentic Italian food, Brunetti offers a wide range of options including gourmet pizza, pasta, gelato and one of Melbourne's most extensive ranges of Italian pastries, cakes and desserts. They also provide catering and online takeaway ordering services. ID 16751
Ransomware	solge.es id16750 View details	2025-01-21	Spain	IT		pending
[AI generated] Solge.es is a Spanish-based Information Technology company primarily focusing on the development of mobile applications, web design, and digital marketing. They aim to increase the effectiveness of enterprises by offering comprehensive IT solutions and digital marketing strategies. Besides these services, they provide training and consultancy in the field of web design and digital marketing. ID 16750
Ransomware	gonzalesusd.net id16708 View details	2025-01-18	United States	Education		pending
[AI generated] I'm sorry for the confusion but gonzalesusd.net is not a company. It's actually the domain for the Gonzales Unified School District in Gonzales, California, primarily responsible for all public education in the city. It incorporates various levels of education including elementary, middle, and high school. It works to create enriching, engaging environments for students, teachers and staff. ID 16708
Ransomware	platinumcollision.com id16692 View details	2025-01-16	United States	Communication / Marketing		pending
[AI generated] Platinum Collision is a reputed automotive repair company specializing in car body repair and paint services. They provide high-quality restorative solutions to vehicle owners, promising excellent craftsmanship, advanced equipment, and certified technicians. They ensure full collision repairs in line with vehicle manufacturer standards. Customer satisfaction, consistency in deliverance and commitment to quality makes Platinum Collision a preferred choice for many. ID 16692
Ransomware	safecoastseafoods.com id16677 View details	2025-01-15	United States	Agriculture / Food		pending
[AI generated] Safecoast Seafoods is a premium seafood sourcing and distribution company. They are focused on delivering the highest quality fresh and frozen seafood to various markets. They partner with sustainable fisheries worldwide, ensuring they offer a wide variety of species. Their services include wholesale distribution, home delivery and even private labeling, meeting the needs of restaurants, markets, and individual consumers alike. ID 16677
Ransomware	greyform.sg id16676 View details	2025-01-15	Singapore	Construction / Real Estate		pending
[AI generated] Greyform Pte Ltd is a Singapore-based construction company specialising in prefab construction methods. With a focus on sustainability and high-efficiency construction, Greyform uses innovative techniques to meet the demands of today's construction industry. Their services include the design, production, logistics and installation of prefabricated components for residential, commercial and civil engineering projects. ID 16676
Ransomware	proexequialesresurgir.com id16675 View details	2025-01-15	Colombia	Communication / Marketing		pending
Inicio \| Proexequiales Resurgi ID 16675
Ransomware	bellandgraham.co.nz id16674 View details	2025-01-15	New Zealand	Hospitality / Food & Beverage / Tourism		pending
Back in 1954, a man named Ray Kroc discovered a small burger restaurant in California, and wrote the first page of our history. From humble beginnings as a small restaurant, we're proud to have become one of the world's leading food service brands with more ID 16674
Ransomware	termopuerto.com id16673 View details	2025-01-15	El Salvador	Communication / Marketing		pending
[AI generated] Termopuerto.com is a logistics company specializing in the integral control of perishable goods. With its operations based in Guatemala, the company ensures efficient and safe handling of products during transportation and storage. It provides advanced temperature-controlled solutions ideal for preserving the quality of goods like fruits, vegetables, and seafood among others. Its services include pre-cooling, packing, labeling, inventory management and customs services. ID 16673
Ransomware	equipo-postal.com id16672 View details	2025-01-15	Mexico	Services		pending
[AI generated] Equipo Postal is a Mexican company that specializes in logistics and delivery services. They offer comprehensive solutions for mail and parcel deliveries, e-commerce distribution, and personalized logistics strategies. With a focus on innovation, they utilise advanced technology to provide efficient and reliable services. Dedicated to customer satisfaction, Equipo Postal Implements custom solutions to meet individual business needs. All while remaining eco-friendly and sustainably focused. ID 16672
Ransomware	ddelta.com.mx id16671 View details	2025-01-15	Mexico	Communication / Marketing		pending
[AI generated] Ddelta.com.mx is a Mexico-based company that specializes in offering software solutions and automation services. Their products and services span across various industries including energy, mining, chemical, food and beverage, and more. They offer solutions that optimize processes, improve production efficiency, reduce operating costs and increase profitability. These include programming, instrumentation, electrical design, etc. The company prides itself on its customer-centric approach. ID 16671
Ransomware	royalinsignia.com id16446 View details	2024-12-29	Singapore	Other	—	pending
Revenue $6.5 Million ID 16446
Ransomware	starkvillesd.com id16445 View details	2024-12-29	United States	Other	—	pending
Revenue $9.1 Million ID 16445
Ransomware	spiro.k12.ok.us id16444 View details	2024-12-29	United States	Other	—	pending
Revenue $5 Million ID 16444
Ransomware	byronunionschooldistrict.us id16443 View details	2024-12-29	United States	Education	—	pending
Revenue $19.3 Million ID 16443
Ransomware	multicoasia.com id16442 View details	2024-12-29	Singapore	Other	—	pending
Revenue $11.6 Million ID 16442
Ransomware	dprinvestments.com id16441 View details	2024-12-29	Anguilla	Finance / Legal / Insurance	—	pending
Revenue $13 Million ID 16441
Ransomware	UPR.SG id16440 View details	2024-12-29	Singapore	Communication / Marketing	—	pending
Revenue $8.9 Million ID 16440
Ransomware	itca.edu.sv id16389 View details	2024-12-25	El Salvador	Other	—	pending
Revenue $56.5 Million ID 16389
Ransomware	etplaw.com id16388 View details	2024-12-25	United Arab Emirates	Finance / Legal / Insurance	—	pending
Revenue $5 Million ID 16388
Ransomware	muswellbrook.nsw.gov.au id16034 View details	2024-12-14	Australia	Other	—	pending
Soon ID 16034
Ransomware	cityofmarlow.com id15999 View details	2024-12-11	United Kingdom	Public Sector	—	pending
Revenue $5 Million ID 15999
Ransomware	nbkenney.com id15998 View details	2024-12-11	United States	Other	—	pending
Revenue $5 Million ID 15998
Ransomware	casaimports.com id15885 View details	2024-12-06	United States	Other	—	pending
Revenue $5 Million ID 15885
Ransomware	ktpartners.ca id15884 View details	2024-12-06	Canada	Other	—	pending
Revenue $5 Million ID 15884
Ransomware	elwood.k12.in.us id15704 View details	2024-11-28	United States	Other	—	pending
Revenue $5 Million ID 15704
Ransomware	scottelec.com id15703 View details	2024-11-28	United States	Other	—	pending
Revenue $19.6 Million ID 15703
Ransomware	helixbermuda.bm id15702 View details	2024-11-28	Bermuda	Other	—	pending
Revenue $5 Million ID 15702
Ransomware	australianhearthealth.org.au id15701 View details	2024-11-28	Australia	Healthcare / Pharma	—	pending
Revenue $7 Million ID 15701
Ransomware	midlandtool.com id15700 View details	2024-11-28	United States	Other	—	pending
Revenue $126 Million ID 15700
Ransomware	mdmcusa.com id15644 View details	2024-11-26	United States	Other	—	pending
Revenue $5 Million ID 15644
Ransomware	titlenine.com id15605 View details	2024-11-24	United States	Other	—	pending
Revenue $60.8 Million ID 15605
Ransomware	www.microlise.com id15547 View details	2024-11-20	United Kingdom	Other	—	pending
Revenue $91.4 Million ID 15547
Ransomware	snowbrand.com.au id15521 View details	2024-11-19	Australia	Other	—	pending
Revenue $9.5 Million ID 15521
Ransomware	piburners.com id15520 View details	2024-11-19	United States	Other	—	pending
ZIP-156GB - Revenue $5 Million ID 15520
Ransomware	tritonsourcing.co.nz id15519 View details	2024-11-19	New Zealand	Other	—	pending
ZIP-10GB - Revenue $5 Million ID 15519
Ransomware	onnicar.it id15518 View details	2024-11-19	Italy	Other	—	pending
ZIP-127GB - Revenue $23.2 Million ID 15518
Ransomware	kingswoodpark.ca id15517 View details	2024-11-19	Canada	Other	—	pending
ZIP-55GB ID 15517
Ransomware	incocommercial.com id15516 View details	2024-11-19	United States	Services	—	pending
ZIP-210GB - Revenue $5 Million ID 15516
Ransomware	euromedix.com id15515 View details	2024-11-19	Belgium	Other	—	pending
ZIP-105GB - Revenue $6.2 Million ID 15515
Ransomware	BusinessTraining.be id15514 View details	2024-11-19	Belgium	Education	—	pending
ZIP-80GB - Revenue $16.3 Million ID 15514
Ransomware	ccseniorservices id15513 View details	2024-11-19	United States	Services	—	pending
ZIP-50GB ID 15513
Ransomware	ib-spieth.de id15512 View details	2024-11-19	Germany	Other	—	pending
ZIP-415B - Revenue $5 Million ID 15512
Ransomware	Safex.us id15511 View details	2024-11-19	United States	Other	—	pending
ZIP-70GB - Revenue $5,4 Million ID 15511
Ransomware	millerservicecompany.com id15510 View details	2024-11-19	United States	Services	—	pending
ZIP-70GB ID 15510
Ransomware	mcauslan.com id15509 View details	2024-11-19	Canada	Other	—	pending
ZIP-50GB - Revenue $16.1 Million ID 15509
Ransomware	stats.gov.bb id15508 View details	2024-11-19	Barbados	Other	—	pending
ZIP-330GB - Revenue $14.5 Million ID 15508
Ransomware	smartdimensions id15507 View details	2024-11-19	United States	Other	—	pending
ZIP-18GB - Revenue $<5 Million ID 15507
Ransomware	westwood id15506 View details	2024-11-19	United States	Other	—	pending
ZIP-50GB - Revenue $8.1 Million ID 15506
Ransomware	threadfxinc/bluedogmerch id15505 View details	2024-11-19	United States	Services	—	pending
ZIP-70GB - Revenue $10.7 Million ID 15505
Ransomware	Pronatec id15504 View details	2024-11-19	Switzerland	Communication / Marketing	—	pending
Revenue $5 Million ID 15504
Ransomware	Gilazo id15503 View details	2024-11-19	Israel	Other	—	pending
Revenue $5 Million ID 15503
Ransomware	OMINT id15502 View details	2024-11-19	Argentina	Other	—	pending
Revenue $540.7 Million ID 15502
Ransomware	NKCE Japan id15501 View details	2024-11-19	Japan	Manufacturing / Engineering	—	pending
[AI generated] NKCE Japan is a company known for its expertise in engineering and manufacturing, specializing in precision components and advanced technological solutions. It serves various industries, providing high-quality products and innovative services. NKCE Japan is committed to excellence and customer satisfaction, leveraging cutting-edge technology and skilled craftsmanship to meet diverse client needs. ID 15501
Ransomware	Richmond Hill Primary Academy id15500 View details	2024-11-19	United Kingdom	Education	—	pending
[AI generated] Richmond Hill Primary Academy is an educational institution focused on providing a nurturing and dynamic learning environment for children. It emphasizes academic excellence, personal growth, and community engagement. The academy offers a broad curriculum designed to foster creativity, critical thinking, and a love for learning, supported by a dedicated team of educators and staff. ID 15500
Ransomware	Active Cosmetic id15499 View details	2024-11-19	Argentina	Other	—	pending
Revenue $26.7 Million ID 15499
Ransomware	O'mara id15498 View details	2024-11-19	Ireland	Other	—	pending
Revenue $5.7 Million ID 15498

Safepay

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (5)

Top Activity Sectors (17)