safepay
First seen November 19, 2024Active599 claimed victims
The claims below are reproduced as posted by safepay on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| hiqbio.com | October 12, 2026 | ransomlook | — |
| dwi-bau.de | October 10, 2026 | ransomlook | — |
| hoteldelfinolugano.ch | October 10, 2026 | ransomlook | — |
| dd-automation.ch | October 5, 2026 | ransomlook | — |
| t-systems.com | October 5, 2026 | ransomlook | — |
| grundens.com | October 5, 2026 | ransomlook | — |
| halservice.it | October 5, 2026 | ransomlook | — |
| bwi-bau.de | October 5, 2026 | ransomlook | — |
| stuecheli.ch | October 5, 2026 | ransomlook | — |
| sterrer.net | October 5, 2026 | ransomlook | — |
| ikhasas.com | October 5, 2026 | ransomlook | — |
| duhaas.sk | October 5, 2026 | ransomlook | — |
| anwo.cl | October 5, 2026 | ransomlook | — |
| hiqbio.com | October 2, 2026 | ransomware_live | — |
| wolfusofsky.de | September 30, 2026 | ransomlook | — |
| assist2enjoy.be | September 30, 2026 | ransomlook | — |
| econ-tec.com | September 30, 2026 | ransomlook | — |
| cromados.com | September 28, 2026 | ransomlook | — |
| auromex.com | September 28, 2026 | ransomlook | — |
| manno.ch | September 28, 2026 | ransomlook | — |
| Holiday Inn Vilnius | September 28, 2026 | ransomlook | — |
| eagroep.com | September 28, 2026 | ransomlook | — |
| sumperk.cz | September 28, 2026 | ransomlook | — |
| bio-strath.com | September 28, 2026 | ransomlook | — |
| fedelmundo.com.ph | September 28, 2026 | ransomlook | — |
| lfgholding.com | September 28, 2026 | ransomlook | — |
| dd-automation.ch | September 25, 2026 | ransomware_live | — |
| econ-tec.com | September 25, 2026 | ransomware_live | — |
| gob.pe | September 15, 2026 | ransomlook | — |
| ara-lyss.ch | September 15, 2026 | ransomlook | — |
| ryomo.co.jp | September 15, 2026 | ransomlook | — |
| stoecklin-kuechen.ch | September 15, 2026 | ransomlook | — |
| meterex.com | September 15, 2026 | ransomlook | — |
| laconcepcion.com.mx | September 15, 2026 | ransomlook | — |
| triniticaring.org | September 15, 2026 | ransomlook | — |
| neumerkel-gmbh.de | September 15, 2026 | ransomlook | — |
| marlinhvac.com | September 15, 2026 | ransomlook | — |
| compunnel.com | September 11, 2026 | ransomware_live | — |
| hbpro.pt | September 8, 2026 | ransomware_live | — |
| gsngestion.es | September 8, 2026 | ransomware_live | — |
| cenmar-manila.com | September 8, 2026 | ransomware_live | — |
| gayafores.es | September 8, 2026 | ransomware_live | — |
| assiprime.it | September 8, 2026 | ransomlook | — |
| cannonpuntana.com | September 8, 2026 | ransomlook | — |
| reichenau.at | September 8, 2026 | ransomlook | — |
| palmettoeyeinstitute.com | September 8, 2026 | ransomlook | — |
| mcnishsteel.com | September 8, 2026 | ransomlook | — |
| recoverycafe.org | September 8, 2026 | ransomlook | — |
| industry.airliquide.kr | August 25, 2026 | ransomlook | — |
| lagegepesca.it | August 24, 2026 | ransomware_live | — |
| industry.airliquide.kr | August 16, 2026 | ransomware_live | — |
| cromados.com | August 10, 2026 | ransomware_live | — |
| multiaqua.com | August 3, 2026 | ransomware_live | — |
| cpu-ag.com | August 3, 2026 | ransomware_live | — |
| southshorerecycling.com | August 3, 2026 | ransomware_live | — |
| azn.co.jp | August 3, 2026 | ransomware_live | — |
| hanan-hov.co.il | August 3, 2026 | ransomware_live | — |
| simonrack.com | August 3, 2026 | ransomware_live | — |
| new-point.it | August 3, 2026 | ransomware_live | — |
| naskdoorinc.com | August 3, 2026 | ransomware_live | — |
| pradotuylaw.com | August 3, 2026 | ransomware_live | — |
| bnpdist.com | July 27, 2026 | ransomware_live | — |
| weier.org | July 27, 2026 | ransomware_live | — |
| braywoodschool.co.uk | July 27, 2026 | ransomware_live | — |
| hst.eu | July 27, 2026 | ransomware_live | — |
| landesmuseum.de | July 27, 2026 | ransomware_live | — |
| haugbuersten.de | July 27, 2026 | ransomware_live | — |
| paritaet-nrw.org | July 27, 2026 | ransomware_live | — |
| moebelmayer.de | July 27, 2026 | ransomware_live | — |
| zinorm.de | July 27, 2026 | ransomware_live | — |
| upland.k12.ca.us | July 24, 2026 | ransomware_live | — |
| mende-grundbesitz.de | July 20, 2026 | ransomware_live | — |
| acsmallmaxwell.com.au | July 20, 2026 | ransomware_live | — |
| industriesjaro.com | July 20, 2026 | ransomware_live | — |
| stroebel-gruppe.de | July 20, 2026 | ransomware_live | — |
| lbb-treuhand.de | July 20, 2026 | ransomware_live | — |
| jaecklin-industrial.de | July 20, 2026 | ransomware_live | — |
| wdk.de | July 20, 2026 | ransomware_live | — |
| granjarinya.com | July 20, 2026 | ransomware_live | — |
| gvsurgicalarts.com | July 15, 2026 | ransomware_live | — |
| shuttlemeadowcc.com | July 13, 2026 | ransomware_live | — |
| hahn-airport.de | July 6, 2026 | ransomware_live | — |
| shw-fr.de | July 6, 2026 | ransomware_live | — |
| lh-wohnverbund-wohnen-nrw.de | July 6, 2026 | ransomware_live | — |
| stedwardscatholicfirstschool.co.uk | July 6, 2026 | ransomware_live | — |
| rtngmbh.de | July 6, 2026 | ransomware_live | — |
| knobel-bau.de | July 6, 2026 | ransomware_live | — |
| bmiprojects.de | July 6, 2026 | ransomware_live | — |
| matrixwebagency.com | July 6, 2026 | ransomware_live | — |
| dia179.com | July 1, 2026 | ransomware_live | — |
| awo-suedost.de | June 23, 2026 | ransomware_live | — |
| ehg.bayern | June 22, 2026 | ransomware_live | — |
| hellmold-plank.de | June 20, 2026 | ransomware_live | — |
| gut-heckenhof.de | June 17, 2026 | ransomware_live | — |
| brscappuccio.it | June 17, 2026 | ransomware_live | — |
| zaunsysteme.de | June 17, 2026 | ransomware_live | — |
| harcourts.net | June 17, 2026 | ransomware_live | — |
| seinordovest.it | June 17, 2026 | ransomware_live | — |
| hoodriversheriff.com | June 15, 2026 | ransomware_live | — |
| aquaclean.com | June 15, 2026 | ransomware_live | — |
Page 1 of 6Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).