About
Written by ThreatCluster from 16 storiesSafepay is a ransomware group that uses an extortion-style model by exfiltrating data from breached organizations and publicly releasing it on the dark web. The group has claimed more than 500 victims, with the most-affected sectors including Manufacturing, Technology, Education, Healthcare, and Business Services, and the countries hit most often being the United States, Germany, the United Kingdom, Canada, and Australia. Recent reporting shows a pattern of data theft followed by public data release on the dark web, illustrated by the attack on Smile Team Orthodontics in which staff details, addresses, and patient payment plans were published. Acronis notes SafePay has targeted managed service providers.
Sectors: Manufacturing, Technology, Healthcare · Countries: US, DE, GB
Recent victims
View all →| Victim | Sector | Country | Views | Posted | Status |
|---|---|---|---|---|---|
| hoteldelfinolugano.ch | Hospitality | Switzerland | — | Oct 7, 2026 | |
| dwi-bau.de | Construction | Germany | — | Oct 9, 2026 | |
| dd-automation.ch dd-automation.ch | Industrial automation | CZ | 6,589 | Oct 5, 2026 | published |
| stuecheli.ch stuecheli.ch | Architecture | CH | 6,163 | Oct 5, 2026 | published |
| bwi-bau.de bwi-bau.de | construction economics and management | DE | 4,151 | Oct 5, 2026 | published |
| halservice.it halservice.it | Telecommunications and ICT | IT | 6,306 | Oct 5, 2026 | published |
| grundens.com grundens.com | Manufacturing | US | 6,351 | Oct 5, 2026 | published |
| t-systems.com t-systems.com | Information and communications technology (ICT) service provider | DE | 6,548 | Oct 5, 2026 | published |
| anwo.cl anwo.cl | HVAC equipment distribution | CL | 4,881 | Oct 5, 2026 | published |
| duhaas.sk duhaas.sk | Construction and engineering | Slovakia | 6,057 | Oct 5, 2026 | published |
| ikhasas.com ikhasas.com | Construction and engineering | Malaysia | 6,153 | Oct 5, 2026 | published |
| sterrer.net sterrer.net | Poultry farming technology | Austria | 6,027 | Oct 5, 2026 | published |
| wolfusofsky.de wolfusofsky.de | Construction and infrastructure services | Germany | 7,698 | Sep 30, 2026 | listed |
| econ-tec.com econ-tec.com | Industrial engineering and automation | Germany | 8,109 | Sep 30, 2026 | published |
| assist2enjoy.be assist2enjoy.be | Wholesale and retail | Belgium | 7,893 | Sep 30, 2026 | listed |
| manno.ch manno.ch | Public sector / municipal services | Switzerland | 10,304 | Sep 28, 2026 | published |
| auromex.com auromex.com | Surface finishing | Thailand | 10,427 | Sep 28, 2026 | published |
| cromados.com cromados.com | Metal finishing and coatings; manufacturing and commercialization | Spain | 10,721 | Sep 28, 2026 | published |
| lfgholding.com lfgholding.com | Wealth management, financial services | Switzerland | 883 | Sep 28, 2026 | listed |
| fedelmundo.com.ph fedelmundo.com.ph | hospital | Philippines | 3,079 | Sep 28, 2026 | listed |
| bio-strath.com bio-strath.com | nutritional and health-support products | Switzerland | 879 | Sep 28, 2026 | listed |
| sumperk.cz sumperk.cz | Public portal / municipal services | Czech Republic | 9,981 | Sep 28, 2026 | published |
| eagroep.com eagroep.com | Human resources / career services | Netherlands | 10,077 | Sep 28, 2026 | published |
| Holiday Inn Vilnius | Hospitality | Lithuania | 10,049 | Sep 28, 2026 | published |
| marlinhvac.com marlinhvac.com | HVAC / Mechanical | US | 13,756 | Sep 15, 2026 | published |
Found by ThreatCluster
73 total from our crawlListed on this group's leak site and not present in the aggregated feeds.