Leak site of safepay, captured by ThreatCluster

safepay

Active

25 tracked victims · First seen Nov 10, 2023 · Last seen Aug 24, 2026

About

Written by ThreatCluster from 17 stories

Safepay is a ransomware group that uses an extortion-style model by exfiltrating data from breached organizations and publicly releasing it on the dark web. The group has claimed more than 500 victims, with the most-affected sectors including Manufacturing, Technology, Education, Healthcare, and Business Services, and the countries hit most often being the United States, Germany, the United Kingdom, Canada, and Australia. Recent reporting shows a pattern of data theft followed by public data release on the dark web, illustrated by the attack on Smile Team Orthodontics in which staff details, addresses, and patient payment plans were published. Acronis notes SafePay has targeted managed service providers.

Sectors: Manufacturing, Technology, Education · Countries: US, DE, GB

Recent victims

View all →
Victim Sector Country Views Posted Status
industry.airliquide.kr Energy KR Aug 25, 2026
lagegepesca.it
lagegepesca.it
Food and Beverage Italy 11,960 Aug 24, 2026 published
granjarinya.com
granjarinya.com
Dairy Spain 25,674 Aug 14, 2026 published
pradotuylaw.com
pradotuylaw.com
Legal services United States 35,031 Aug 3, 2026 published
naskdoorinc.com
naskdoorinc.com
Construction United States 35,169 Aug 3, 2026 published
new-point.it
new-point.it
Apparel IT 35,417 Aug 3, 2026 published
simonrack.com
simonrack.com
Manufacturing Spain 38,032 Aug 3, 2026 published
hanan-hov.co.il Construction Israel Aug 3, 2026
azn.co.jp Consulting Japan Aug 3, 2026
southshorerecycling.com Construction United States Aug 3, 2026
cpu-ag.com
cpu-ag.com
Financial Services Germany 34,873 Aug 3, 2026 published
multiaqua.com
multiaqua.com
HVAC United States 34,844 Aug 3, 2026 published
zinorm.de Engineering hardware Germany Jul 27, 2026
moebelmayer.de Engineering DE Jul 27, 2026
paritaet-nrw.org Non-profit / Social services Germany Jul 27, 2026
haugbuersten.de Consumer Cleaning Products Germany Jul 27, 2026
landesmuseum.de Education DE Jul 27, 2026
hst.eu Engineering Germany Jul 27, 2026
braywoodschool.co.uk Education GB Jul 27, 2026
weier.org Building Services Germany Jul 27, 2026
bnpdist.com Wholesale Distributor United States Jul 27, 2026
upland.k12.ca.us Education United States Jul 24, 2026
gvsurgicalarts.com Healthcare United States Jul 24, 2026
wdk.de Other DE Jul 20, 2026
jaecklin-industrial.de Manufacturing Germany Jul 20, 2026

Found by ThreatCluster

22 total from our crawl

Listed on this group's leak site and not present in the aggregated feeds.

Simon Rack
simonrack.com
Sep 3, 2026
Naskdoor Inc
naskdoorinc.com
Sep 1, 2026
Prado Tuylaw
pradotuylaw.com
Sep 1, 2026
Lagege Pesca
lagegepesca.it
Sep 1, 2026
Pradotuylaw
pradotuylaw.com
Sep 1, 2026
Naskdoor Inc.
naskdoorinc.com
Sep 1, 2026
Prado Tuy Law
pradotuylaw.com
Aug 31, 2026
Granjarinya
granjarinya.com
Aug 31, 2026
Air Liquide
industry.airliquide.kr · Industrial gases
Aug 31, 2026
Multiaqua
multiaqua.com
Aug 31, 2026
CPU-AG
cpu-ag.com · Software
Aug 31, 2026
New Point
new-point.it
Aug 31, 2026
Simonrack
simonrack.com · Manufacturing
Aug 31, 2026
Nask Door Inc.
naskdoorinc.com
Aug 31, 2026

All ransomware groups · Dark web intelligence