safepay
First seen November 19, 2024Active599 claimed victims
The claims below are reproduced as posted by safepay on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| ibague.losolivos.co | May 7, 2025 | ransomware_live | — |
| cs-groupllc.com | May 6, 2025 | ransomware_live | — |
| spring-green.com/petbutler.com | May 5, 2025 | ransomware_live | — |
| radsports.com | May 2, 2025 | ransomware_live | — |
| liberty-township.com | May 2, 2025 | ransomware_live | — |
| rtblegal.com.au | May 1, 2025 | ransomware_live | — |
| universityacademy.org | May 1, 2025 | ransomware_live | — |
| mcsl.de | May 1, 2025 | ransomware_live | — |
| ozarkah2o.com | April 30, 2025 | ransomware_live | — |
| hennertanklines.com | April 30, 2025 | ransomware_live | — |
| rusindustries.com | April 30, 2025 | ransomware_live | — |
| ngca.net | April 29, 2025 | ransomware_live | — |
| labbeemint.com | April 29, 2025 | ransomware_live | — |
| awo-giessen.org | April 27, 2025 | ransomware_live | — |
| wnyenergy.com | April 24, 2025 | ransomware_live | — |
| realschule-karlstadt.org | April 24, 2025 | ransomware_live | — |
| distribution2.com | April 23, 2025 | ransomware_live | — |
| redsquaredentalcare.com | April 22, 2025 | ransomware_live | — |
| servicecentermetals.com | April 22, 2025 | ransomware_live | — |
| clarkmechanicalinc.com | April 21, 2025 | ransomware_live | — |
| sb-p.de | April 19, 2025 | ransomware_live | — |
| aplusmachining.com | April 17, 2025 | ransomware_live | — |
| buechel-online.com | April 17, 2025 | ransomware_live | — |
| frapack.de | April 16, 2025 | ransomware_live | — |
| eichele-bau.de | April 16, 2025 | ransomware_live | — |
| foerster-schwanau.de | April 16, 2025 | ransomware_live | — |
| extremefire.com.au | April 16, 2025 | ransomware_live | — |
| kirkel.de | April 16, 2025 | ransomware_live | — |
| getriebetech.de | April 16, 2025 | ransomware_live | — |
| hurst-schroeder.de | April 16, 2025 | ransomware_live | — |
| heinrich-steinhardt.de | April 16, 2025 | ransomware_live | — |
| itec-gmbh.com | April 16, 2025 | ransomware_live | — |
| join-the-quest.co.uk | April 16, 2025 | ransomware_live | — |
| prais.ro | April 16, 2025 | ransomware_live | — |
| abfiad.nl | April 15, 2025 | ransomware_live | — |
| moorecoal.com | April 15, 2025 | ransomware_live | — |
| dawg-dok.de | April 15, 2025 | ransomware_live | — |
| gravelec.ch | April 14, 2025 | ransomware_live | — |
| visco.de | April 14, 2025 | ransomware_live | — |
| olympusaero.com | April 12, 2025 | ransomware_live | — |
| zvaonline.com | April 12, 2025 | ransomware_live | — |
| schapmann | April 11, 2025 | ransomware_live | — |
| rgvengineering.co.uk | April 11, 2025 | ransomware_live | — |
| notar-roemer-troisdorf.de | April 11, 2025 | ransomware_live | — |
| donowentire.com | April 11, 2025 | ransomware_live | — |
| schoene-aussicht-kassel.de | April 10, 2025 | ransomware_live | — |
| servicedecorating.com | April 10, 2025 | ransomware_live | — |
| sfhumanesociety.org | April 9, 2025 | ransomware_live | — |
| This entry has been removed following a request from the company. | April 8, 2025 | ransomware_live | — |
| ctd-dortmund.de | April 8, 2025 | ransomware_live | — |
| meeksgroup.com | April 8, 2025 | ransomware_live | — |
| niemann.de | April 7, 2025 | ransomware_live | — |
| heilbronn.de | April 6, 2025 | ransomware_live | — |
| eu-rec.de | April 5, 2025 | ransomware_live | — |
| scheuerle-stuttgart.de | April 5, 2025 | ransomware_live | — |
| mylikowines.co.uk | April 5, 2025 | ransomware_live | — |
| packagesteel.com | April 5, 2025 | ransomware_live | — |
| morricetransportation.com | April 4, 2025 | ransomware_live | — |
| gewandhaus.bayern | April 4, 2025 | ransomware_live | — |
| metten-maas.de | April 4, 2025 | ransomware_live | — |
| theoverheaddoorco.com | April 3, 2025 | ransomware_live | — |
| hagemann-h.de | April 2, 2025 | ransomware_live | — |
| igpi.co.jp | March 31, 2025 | ransomware_live | — |
| marcom-inc.ca | March 30, 2025 | ransomware_live | — |
| retycol.com | March 30, 2025 | ransomware_live | — |
| wrm.org | March 30, 2025 | ransomware_live | — |
| ecconstructors.com | March 30, 2025 | ransomware_live | — |
| westwarwickwelding.com | March 30, 2025 | ransomware_live | — |
| tramann.de | March 30, 2025 | ransomware_live | — |
| vcvitanzasons.com | March 30, 2025 | ransomware_live | — |
| metalogicinspection.com | March 30, 2025 | ransomware_live | — |
| bohrerhof.de | March 30, 2025 | ransomware_live | — |
| beaudry.ca | March 30, 2025 | ransomware_live | — |
| cjs-buerodienstleistungen.de | March 30, 2025 | ransomware_live | — |
| blunk-gmbh.de | March 30, 2025 | ransomware_live | — |
| alpsteel.com | March 30, 2025 | ransomware_live | — |
| albrecht-partner-steuerberatung.de | March 30, 2025 | ransomware_live | — |
| swr.school | March 30, 2025 | ransomware_live | — |
| vinylvisions.com | March 30, 2025 | ransomware_live | — |
| tieraerzte-warburg.de | March 30, 2025 | ransomware_live | — |
| creativeunited.org.uk | March 30, 2025 | ransomware_live | — |
| dreng.com | March 30, 2025 | ransomware_live | — |
| kize-weisser-stein.de | March 29, 2025 | ransomware_live | — |
| mooregiles.com | March 28, 2025 | ransomware_live | — |
| biglevel.net | March 23, 2025 | ransomware_live | — |
| compassionhealthcare.org | March 22, 2025 | ransomware_live | — |
| kolpa.com.pe | March 22, 2025 | ransomware_live | — |
| saiedu.fi | March 19, 2025 | ransomware_live | — |
| helixtools.co.uk | March 19, 2025 | ransomware_live | — |
| dosjm.com | March 19, 2025 | ransomware_live | — |
| mayaassurance.com | March 15, 2025 | ransomware_live | — |
| adolphelawgroup.com | March 15, 2025 | ransomware_live | — |
| argusdatainsights.de | March 14, 2025 | ransomware_live | — |
| bloomfamilyeyesurgeons.com | March 13, 2025 | ransomware_live | — |
| cali.losolivos.co | March 11, 2025 | ransomware_live | — |
| motomecanica.com | March 11, 2025 | ransomware_live | — |
| jockeysalud.com.pe | March 11, 2025 | ransomware_live | — |
| lgipr.com | March 11, 2025 | ransomware_live | — |
| havenresorts.com | March 11, 2025 | ransomware_live | — |
| tradingacademy.com | March 11, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).