safepay
First seen November 19, 2024Active599 claimed victims
The claims below are reproduced as posted by safepay on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| bautz-maschinenbau.de | June 15, 2026 | ransomware_live | — |
| musenet.co.jp | June 15, 2026 | ransomware_live | — |
| kawaius.com | June 15, 2026 | ransomware_live | — |
| tokyocivil.co.jp | June 15, 2026 | ransomware_live | — |
| caritas-koblenz.de | June 15, 2026 | ransomware_live | — |
| eaglecrestlife.org | June 13, 2026 | ransomware_live | — |
| timetex.de | June 7, 2026 | ransomware_live | — |
| cenesco.de | June 6, 2026 | ransomware_live | — |
| compactmould.com | June 1, 2026 | ransomware_live | — |
| verzolla.com | June 1, 2026 | ransomware_live | — |
| lcnet.eu | June 1, 2026 | ransomware_live | — |
| soraris.it | June 1, 2026 | ransomware_live | — |
| parsa-beauty.de | June 1, 2026 | ransomware_live | — |
| tavolaspa.com | June 1, 2026 | ransomware_live | — |
| cyuou.com | May 25, 2026 | ransomware_live | — |
| tme-rusta.de | May 25, 2026 | ransomware_live | — |
| eitecpro.co.jp | May 25, 2026 | ransomware_live | — |
| iql-nog.com | May 21, 2026 | ransomware_live | — |
| olipes.com | May 19, 2026 | ransomware_live | — |
| Berlinmobil.de | May 18, 2026 | ransomware_live | — |
| adlan.com | May 18, 2026 | ransomware_live | — |
| ashleytimber.co.uk | May 18, 2026 | ransomware_live | — |
| mediafrance.de | May 18, 2026 | ransomware_live | — |
| hautarzt-budihardja.de | May 18, 2026 | ransomware_live | — |
| soavegel.it | May 6, 2026 | ransomware_live | — |
| globalmerchservices.com | May 6, 2026 | ransomware_live | — |
| studioubertazzi.it | May 6, 2026 | ransomware_live | — |
| ettp.be | May 6, 2026 | ransomware_live | — |
| mbk-gmbh.de | May 6, 2026 | ransomware_live | — |
| jmige.com | May 6, 2026 | ransomware_live | — |
| gingerichtrucking.com | May 6, 2026 | ransomware_live | — |
| smp.cat | May 6, 2026 | ransomware_live | — |
| hughstirling.co.uk | May 5, 2026 | ransomware_live | — |
| fital-treppenlifte.de | May 4, 2026 | ransomware_live | — |
| zonaovest.to.it | May 4, 2026 | ransomware_live | — |
| maiadouro.pt | May 4, 2026 | ransomware_live | — |
| dahlgrenscement.se | May 4, 2026 | ransomware_live | — |
| hokuyo2006.co.jp | May 4, 2026 | ransomware_live | — |
| vdmtrucking.com | April 29, 2026 | ransomware_live | — |
| hpk.hamburg | April 26, 2026 | ransomware_live | — |
| harrisoncountywv.com | April 25, 2026 | ransomware_live | — |
| st-bernards.bham.sch.uk | April 17, 2026 | ransomware_live | — |
| thruwayplumbingservice.com | April 17, 2026 | ransomware_live | — |
| lynxprecast.co.uk | April 17, 2026 | ransomware_live | — |
| genealogysa.org.au | April 17, 2026 | ransomware_live | — |
| bbalawgroup.com | April 17, 2026 | ransomware_live | — |
| energyaction.com.au | April 13, 2026 | ransomware_live | — |
| id-s.de | April 2, 2026 | ransomware_live | — |
| thenavigatorcompany.com | March 17, 2026 | ransomware_live | — |
| mattandsteve.com | March 17, 2026 | ransomware_live | — |
| briwaycarriers.com | March 17, 2026 | ransomware_live | — |
| tiefenbachergroup.com | March 17, 2026 | ransomware_live | — |
| brookercg.com | March 17, 2026 | ransomware_live | — |
| academyhealth.org | March 16, 2026 | ransomware_live | — |
| printroom.co.uk | March 8, 2026 | ransomware_live | — |
| bootstransport.ca | March 7, 2026 | ransomware_live | — |
| smileteam.com.au | March 6, 2026 | ransomware_live | — |
| Franz-Sales-Haus.de | March 3, 2026 | ransomware_live | — |
| favellefavco.com | February 24, 2026 | ransomware_live | — |
| abfall-kreis-kassel.de | February 16, 2026 | ransomware_live | — |
| groupepiche.ca | February 7, 2026 | ransomware_live | — |
| kres.cz | February 7, 2026 | ransomware_live | — |
| cheeky.com.ar | February 5, 2026 | ransomware_live | — |
| ripobec.com | February 2, 2026 | ransomware_live | — |
| freidarothman.com | January 26, 2026 | ransomware_live | — |
| interr.com | January 24, 2026 | ransomware_live | — |
| trulinemfg.com | January 24, 2026 | ransomware_live | — |
| lcpublishinggroup.com | January 24, 2026 | ransomware_live | — |
| firstcambodia.com.kh | January 24, 2026 | ransomware_live | — |
| wohnverbund-st-gertrud.de | January 19, 2026 | ransomware_live | — |
| abcseamless.com | January 19, 2026 | ransomware_live | — |
| rlc.es | January 14, 2026 | ransomware_live | — |
| atadler.com.sg | January 13, 2026 | ransomware_live | — |
| superiordrywall.com | January 11, 2026 | ransomware_live | — |
| adifse.com.ar | January 9, 2026 | ransomware_live | — |
| gsglobalresources.com | January 4, 2026 | ransomware_live | — |
| estrumar.es | December 29, 2025 | ransomware_live | — |
| precisionaluminum.ca | December 29, 2025 | ransomware_live | — |
| sproutnet.com | December 29, 2025 | ransomware_live | — |
| investigacionesmedicas.com | December 29, 2025 | ransomware_live | — |
| usdaw.org.uk | December 29, 2025 | ransomware_live | — |
| knightgroup.co.uk | December 29, 2025 | ransomware_live | — |
| davidrosenbakerysupply.com | December 29, 2025 | ransomware_live | — |
| setex-textil.de | December 29, 2025 | ransomware_live | — |
| ipu.co.il | December 29, 2025 | ransomware_live | — |
| larosadelmonte.com | December 27, 2025 | ransomware_live | — |
| wadzeck-stiftung.de | December 27, 2025 | ransomware_live | — |
| vanvenrooy.com | December 27, 2025 | ransomware_live | — |
| debralmorrison.com | December 27, 2025 | ransomware_live | — |
| studioelad.it | December 27, 2025 | ransomware_live | — |
| ryc.org | December 27, 2025 | ransomware_live | — |
| heatcel.co.uk | December 27, 2025 | ransomware_live | — |
| envases-group.com | December 24, 2025 | ransomware_live | — |
| cmac-llc.com | December 24, 2025 | ransomware_live | — |
| massfd.org | December 24, 2025 | ransomware_live | — |
| vitatrac.com.gt | December 24, 2025 | ransomware_live | — |
| nhpsa.com.ar | December 24, 2025 | ransomware_live | — |
| 47club.jp | December 24, 2025 | ransomware_live | — |
| maxdream.tur.ar | December 24, 2025 | ransomware_live | — |
| polhun.pl | December 24, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).