safepay
First seen November 19, 2024Active599 claimed victims
The claims below are reproduced as posted by safepay on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| wagner-transporte.com | March 11, 2025 | ransomware_live | — |
| willms-fleisch.de | March 5, 2025 | ransomware_live | — |
| schuhbode.de | March 5, 2025 | ransomware_live | — |
| norson.com | March 1, 2025 | ransomware_live | — |
| children-ne.org.uk | February 28, 2025 | ransomware_live | — |
| terrell.k12.ga.us | February 27, 2025 | ransomware_live | — |
| comfort.de | February 25, 2025 | ransomware_live | — |
| prestigeer.com | February 20, 2025 | ransomware_live | — |
| estilointeriors.co.uk | February 19, 2025 | ransomware_live | — |
| fd-friedrich.com | February 18, 2025 | ransomware_live | — |
| bristolhose.com | February 17, 2025 | ransomware_live | — |
| system-toolsgmbh.de | February 16, 2025 | ransomware_live | — |
| brightonaustralia.com.au | February 14, 2025 | ransomware_live | — |
| foyernotredamedepaix.be | February 12, 2025 | ransomware_live | — |
| ziese.net | February 10, 2025 | ransomware_live | — |
| ultimateclasslimo.com | February 7, 2025 | ransomware_live | — |
| stjerome.org | February 5, 2025 | ransomware_live | — |
| plasseramerican.com | February 4, 2025 | ransomware_live | — |
| brewsterfiredepartment.org | February 3, 2025 | ransomware_live | — |
| rwrhine.com | January 30, 2025 | ransomware_live | — |
| cellsciencesystems.com | January 25, 2025 | ransomware_live | — |
| welcomewagon.com | January 25, 2025 | ransomware_live | — |
| www.iecsolutions.com | January 25, 2025 | ransomware_live | — |
| fastrans.com | January 24, 2025 | ransomware_live | — |
| BBBIND.COM | January 23, 2025 | ransomware_live | — |
| derrimon.com | January 22, 2025 | ransomware_live | — |
| lowernazareth.com | January 22, 2025 | ransomware_live | — |
| codesco.com | January 20, 2025 | ransomware_live | — |
| globexusa.com | January 19, 2025 | ransomware_live | — |
| harcoboe.net | January 18, 2025 | ransomware_live | — |
| mcpathology.com | January 16, 2025 | ransomware_live | — |
| termopuerto.com | January 15, 2025 | ransomware_live | — |
| greyform.sg | January 15, 2025 | ransomware_live | — |
| solge.es | January 14, 2025 | ransomware_live | — |
| brunetti.com | January 14, 2025 | ransomware_live | — |
| nutripack.eu | January 14, 2025 | ransomware_live | — |
| bigotti.ro | January 14, 2025 | ransomware_live | — |
| ddelta.com.mx | January 9, 2025 | ransomware_live | — |
| platinumcollision.com | January 9, 2025 | ransomware_live | — |
| conduent.com | January 9, 2025 | ransomware_live | — |
| equipo-postal.com | January 7, 2025 | ransomware_live | — |
| safecoastseafoods.com | January 4, 2025 | ransomware_live | — |
| dprinvestments.com | December 29, 2024 | ransomware_live | — |
| spiro.k12.ok.us | December 29, 2024 | ransomware_live | — |
| semesco.com | December 29, 2024 | ransomware_live | — |
| paradiseschools.org | December 29, 2024 | ransomware_live | — |
| proexequialesresurgir.com | December 26, 2024 | ransomware_live | — |
| muscogee.k12.ga.us | December 26, 2024 | ransomware_live | — |
| etplaw.com | December 25, 2024 | ransomware_live | — |
| royalinsignia.com | December 22, 2024 | ransomware_live | — |
| bellandgraham.co.nz | December 22, 2024 | ransomware_live | — |
| itca.edu.sv | December 21, 2024 | ransomware_live | — |
| byronunionschooldistrict.us | December 20, 2024 | ransomware_live | — |
| starkvillesd.com | December 20, 2024 | ransomware_live | — |
| gaylord.org | December 19, 2024 | ransomware_live | — |
| gonzalesusd.net | December 17, 2024 | ransomware_live | — |
| multicoasia.com | December 13, 2024 | ransomware_live | — |
| maxusgroup.com | December 12, 2024 | ransomware_live | — |
| UPR.SG | December 10, 2024 | ransomware_live | — |
| muswellbrook.nsw.gov.au | December 3, 2024 | ransomware_live | — |
| midlandtool.com | November 28, 2024 | ransomware_live | — |
| australianhearthealth.org.au | November 28, 2024 | ransomware_live | — |
| helixbermuda.bm | November 28, 2024 | ransomware_live | — |
| scottelec.com | November 28, 2024 | ransomware_live | — |
| elwood.k12.in.us | November 28, 2024 | ransomware_live | — |
| nbkenney.com | November 28, 2024 | ransomware_live | — |
| cityofmarlow.com | November 27, 2024 | ransomware_live | — |
| www.microlise.com | November 20, 2024 | ransomware_live | — |
| westwood | November 19, 2024 | ransomware_live | — |
| ccseniorservices | November 19, 2024 | ransomware_live | — |
| onnicar.it | November 19, 2024 | ransomware_live | — |
| ktpartners.ca | November 18, 2024 | ransomware_live | — |
| casaimports.com | November 16, 2024 | ransomware_live | — |
| mdmcusa.com | November 8, 2024 | ransomware_live | — |
| titlenine.com | November 2, 2024 | ransomware_live | — |
| smartdimensions | October 29, 2024 | ransomware_live | — |
| stats.gov.bb | October 29, 2024 | ransomware_live | — |
| mcauslan.com | October 27, 2024 | ransomware_live | — |
| millerservicecompany.com | October 25, 2024 | ransomware_live | — |
| Safex.us | October 23, 2024 | ransomware_live | — |
| lrcpa.com | October 23, 2024 | ransomware_live | — |
| ib-spieth.de | October 21, 2024 | ransomware_live | — |
| threadfxinc/bluedogmerch | October 18, 2024 | ransomware_live | — |
| BusinessTraining.be | October 18, 2024 | ransomware_live | — |
| incocommercial.com | October 17, 2024 | ransomware_live | — |
| euromedix.com | October 14, 2024 | ransomware_live | — |
| kingswoodpark.ca | October 10, 2024 | ransomware_live | — |
| tritonsourcing.co.nz | October 8, 2024 | ransomware_live | — |
| Pronatec | October 6, 2024 | ransomware_live | — |
| piburners.com | October 4, 2024 | ransomware_live | — |
| OMINT | September 27, 2024 | ransomware_live | — |
| NKCE Japan | September 26, 2024 | ransomware_live | — |
| snowbrand.com.au | September 26, 2024 | ransomware_live | — |
| Gilazo | September 25, 2024 | ransomware_live | — |
| Richmond Hill Primary Academy | September 20, 2024 | ransomware_live | — |
| Active Cosmetic | September 17, 2024 | ransomware_live | — |
| O'mara | August 26, 2024 | ransomware_live | — |
| bussepc.com | January 19, 2024 | ransomware_live | — |
| bartec.com | November 10, 2023 | ransomware_live | — |
← NewerPage 6 of 6
Claim data from ransomware.live and RansomLook (CC BY 4.0).