safepay
First seen November 19, 2024Active550 claimed victims
The claims below are reproduced as posted by safepay on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| inpipeproducts.com | November 13, 2025 | ransomware_live | — |
| doversd.org | November 12, 2025 | ransomware_live | — |
| himmelstein.com | November 11, 2025 | ransomware_live | — |
| glendaleobgyn.com | November 11, 2025 | ransomware_live | — |
| ielplumbing.com | November 10, 2025 | ransomware_live | — |
| rehmann.de | November 10, 2025 | ransomware_live | — |
| mcintoshlabs.com | November 5, 2025 | ransomware_live | — |
| coloradopowerline.com | November 1, 2025 | ransomware_live | — |
| lampus.com | October 30, 2025 | ransomware_live | — |
| greenhouseapt.com | October 24, 2025 | ransomware_live | — |
| bannenbergandrowell.com | October 24, 2025 | ransomware_live | — |
| mino-in.co.jp | October 24, 2025 | ransomware_live | — |
| xortec.de | October 24, 2025 | ransomware_live | — |
| constructiondprovost.com | October 24, 2025 | ransomware_live | — |
| feldmanandlopez.com | October 22, 2025 | ransomware_live | — |
| holtzofficesupport.com | October 18, 2025 | ransomware_live | — |
| cmlmachinery.com | October 10, 2025 | ransomware_live | — |
| portofuneralhomes.net | October 10, 2025 | ransomware_live | — |
| glatten.de | October 10, 2025 | ransomware_live | — |
| krne.com | October 10, 2025 | ransomware_live | — |
| bridgenetcommunicationsrgv.com | October 10, 2025 | ransomware_live | — |
| tango-hotel.com.ar | October 10, 2025 | ransomware_live | — |
| empirico-mr.com | October 10, 2025 | ransomware_live | — |
| healthandvitalitycenter.com | October 9, 2025 | ransomware_live | — |
| halbarstainless.com | September 5, 2025 | ransomware_live | — |
| ggw.net | September 3, 2025 | ransomware_live | — |
| waterfordsurgicalcenter.com | September 1, 2025 | ransomware_live | — |
| kclub.ie | September 1, 2025 | ransomware_live | — |
| templeemanu-el.org | August 29, 2025 | ransomware_live | — |
| uwock.ca | August 29, 2025 | ransomware_live | — |
| zanettisrl.it | August 29, 2025 | ransomware_live | — |
| dasmeshschool.com | August 29, 2025 | ransomware_live | — |
| optivosa.com | August 26, 2025 | ransomware_live | — |
| ferienwohnungen.de | August 26, 2025 | ransomware_live | — |
| biosorthopedics.com | August 25, 2025 | ransomware_live | — |
| venetianassociates.com | August 22, 2025 | ransomware_live | — |
| armourhome.co.uk | August 21, 2025 | ransomware_live | — |
| transelectric.co.il | August 19, 2025 | ransomware_live | — |
| childrenscouncil.org | August 19, 2025 | ransomware_live | — |
| gosheating.co.uk | August 18, 2025 | ransomware_live | — |
| alliancesteelco.com | August 18, 2025 | ransomware_live | — |
| cityofmiddletown.org | August 17, 2025 | ransomware_live | — |
| decor-metall.de | August 15, 2025 | ransomware_live | — |
| drcloudemr.com | August 14, 2025 | ransomware_live | — |
| slusarski.com | August 14, 2025 | ransomware_live | — |
| browneco.com | August 14, 2025 | ransomware_live | — |
| sandersonmanagement.com | August 8, 2025 | ransomware_live | — |
| mdneal.com | August 8, 2025 | ransomware_live | — |
| waverlychildcare.org | August 8, 2025 | ransomware_live | — |
| scottschiff.com | August 5, 2025 | ransomware_live | — |
| wilsonatllaw.com | August 4, 2025 | ransomware_live | — |
| osdcourtks.org | August 4, 2025 | ransomware_live | — |
| mauilodging.com | August 1, 2025 | ransomware_live | — |
| umweltprofis.at | August 1, 2025 | ransomware_live | — |
| usai.io | August 1, 2025 | ransomware_live | — |
| ingrammicro.com | July 29, 2025 | ransomware_live | — |
| havtechpa.com | July 26, 2025 | ransomware_live | — |
| swfldermatology.com | July 26, 2025 | ransomware_live | — |
| wta-inc.com | July 26, 2025 | ransomware_live | — |
| tele-optics.com | July 26, 2025 | ransomware_live | — |
| ridgefield.org | July 24, 2025 | ransomware_live | — |
| bisa.com.pe | July 22, 2025 | ransomware_live | — |
| stichtingjohannesbosco.com | July 22, 2025 | ransomware_live | — |
| thecelestehotel.com | July 18, 2025 | ransomware_live | — |
| chamberlainhuckeriede.com | July 14, 2025 | ransomware_live | — |
| oiwky.com | July 14, 2025 | ransomware_live | — |
| ppa-eng.com.org | July 7, 2025 | ransomware_live | — |
| bthcpa.com | July 5, 2025 | ransomware_live | — |
| jansen-aschendorf.de | July 1, 2025 | ransomware_live | — |
| norpak.com | June 30, 2025 | ransomware_live | — |
| godbyhearth.com | June 30, 2025 | ransomware_live | — |
| listgrove.com | June 30, 2025 | ransomware_live | — |
| camaravalencia.com | June 30, 2025 | ransomware_live | — |
| albertaindustrialcontrols.com | June 27, 2025 | ransomware_live | — |
| batemangroundworks.co.uk | June 26, 2025 | ransomware_live | — |
| rivertoncabinets.com | June 26, 2025 | ransomware_live | — |
| tdunhamcpa.com | June 24, 2025 | ransomware_live | — |
| hardwicktactical.com | June 24, 2025 | ransomware_live | — |
| lipcare.de | June 20, 2025 | ransomware_live | — |
| akd-ekbo.de | June 19, 2025 | ransomware_live | — |
| schliessmeyer.de | June 18, 2025 | ransomware_live | — |
| lafayettefamilyymca.org | June 17, 2025 | ransomware_live | — |
| jphrs-waghaeusel.de | June 17, 2025 | ransomware_live | — |
| faltner.de | June 16, 2025 | ransomware_live | — |
| phillips66lubricants.com | June 16, 2025 | ransomware_live | — |
| moffett-towers-club.com | June 14, 2025 | ransomware_live | — |
| welcometosedgebrook.com | June 14, 2025 | ransomware_live | — |
| fmsarchitects.com | June 14, 2025 | ransomware_live | — |
| avgouleaschool.gr | June 14, 2025 | ransomware_live | — |
| companionsandhomemakers.com | June 14, 2025 | ransomware_live | — |
| salemma.com.py | June 13, 2025 | ransomware_live | — |
| parksidegroup.co.uk | June 11, 2025 | ransomware_live | — |
| electro-seal.com | June 9, 2025 | ransomware_live | — |
| mytaac.com | June 7, 2025 | ransomware_live | — |
| mccn.org | June 6, 2025 | ransomware_live | — |
| dossenterprises.com | June 6, 2025 | ransomware_live | — |
| naxis.net | June 6, 2025 | ransomware_live | — |
| horanbarker.com | June 4, 2025 | ransomware_live | — |
| digitalwarroom.com | June 3, 2025 | ransomware_live | — |
| ochsinc.org.com | June 3, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).