THREAT ACTOR
SAFEPAY_
ActiveSAFEPAY is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of SAFEPAY, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
574
Victims tracked
2 / 16
Active mirrors
2024-11-20
First listing
2026-09-15
Most recent
Victims by year
- 2026 148
- 2025 380
- 2024 46
Leak site mirrors
16 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onionsnapshot · 2024-11-16 07:32 -
nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onionSAFEPAY snapshot · 2025-06-17 12:22 -
qkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onionsnapshot · 2025-06-21 20:12 -
iieavvi4wtiuijas3zw4w54a5n2srnccm2fcb3jcrvbb7ap5tfphw6ad.onionsnapshot · 2025-06-21 20:21 -
fcde4o7iquaspdbo5yetwqn3rfueet2zfy3wjosrc5dznyccwbiz6oyd.onionWelcome to nginx! snapshot · 2025-03-04 09:02 -
crmbcdcdwoex6dzajbicgzrsuw2t76pomajwdpi2mb2babbfdgcc6xid.onion404 - Not Found snapshot · 2025-09-11 20:14 -
j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onionSAFEPAY snapshot · 2025-09-13 08:18 -
wmgres25e43uwgebctgofo2qe23kf5vqevixiulubpovdglyizfugryd.onionAccess denied snapshot · 2025-10-29 05:04 -
dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onionsnapshot · 2025-08-08 07:57 -
oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onionsnapshot · 2025-08-08 07:57 -
safepay.tonsnapshot · 2025-08-08 07:58 -
safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onionSafepay Blog snapshot · 2026-09-23 03:04 -
duslj3vgel72rilqlvvlo2qw6jybmvbcdmcm4n63kyivveeif6u2xrad.onion404 — Not Found snapshot · 2026-07-29 12:39 -
dwizzpmqny2ddazasljow3cdd4doqscouwywd3gz5jbsxvzerqx3lwid.onionsnapshot · 2026-09-23 02:04 -
a5d3otrzcgbprssbut7fm7ykl2edbcrhzxi3g3qhs327jwp44yovi2id.onion404 — Not Found snapshot · 2026-09-23 03:00 -
4feb4566k5oqs5w4ksmbqcgduposx5r4oegkcngiedqfyhmtt3bxo4ad.onionsnapshot · 2026-09-16 20:48
Recent victims
The 50 most recent victims claimed by SAFEPAY. Total in the index: 574.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-15 | marlinhvac.com | Founded in 1989 by Michael and Richard Pellino, the company has develo… |
| 2026-09-15 | neumerkel-gmbh.de | The business traces its origins to 1963 and has operated under the Neu… |
| 2026-09-15 | triniticaring.org | The organization is jointly owned by Guardian Angels Senior Services o… |
| 2026-09-15 | laconcepcion.com.mx | The organization identifies itself as one of the principal private hea… |
| 2026-09-15 | meterex.com | The company is headquartered in Langenfeld, North Rhine-Westphalia, an… |
| 2026-09-15 | stoecklin-kuechen.ch | The company is based in Aesch near Basel and has developed from a trad… |
| 2026-09-15 | ryomo.co.jp | Established in January 1970 as a regional computer-services center, th… |
| 2026-09-15 | ara-lyss.ch | Its headquarters and main wastewater-treatment facility are located at… |
| 2026-09-15 | gob.pe | It serves as the country's primary online point of contact between pub… |
| 2026-09-12 | compunnel.com | The company provides a combination of talent acquisition, IT consultin… |
| 2026-09-09 | gayafores.es | The company is headquartered in Onda, Castellón, one of Europe's most … |
| 2026-09-09 | cenmar-manila.com | The company was registered with the Philippine Securities and Exchange… |
| 2026-09-09 | gsngestion.es | The company is based in Villaviciosa de Odón, Madrid, and operates thr… |
| 2026-09-09 | hbpro.pt | Established in 1994, the company has more than three decades of experi… |
| 2026-09-08 | recoverycafe.org | The organization was founded in 2003 and opened its first physical caf… |
| 2026-09-08 | mcnishsteel.com | The company is headquartered in Edmonton, Alberta, and was founded in … |
| 2026-09-08 | palmettoeyeinstitute.com | The practice was founded by Dr. Prat Itharat, a board-certified ophtha… |
| 2026-09-08 | reichenau.at | The official website, reichenau.at, serves as the municipality's centr… |
| 2026-09-08 | cannonpuntana.com | The company operated in Argentina and was historically connected with … |
| 2026-09-08 | assiprime.it | The company provides insurance brokerage, risk-management, financial c… |
| 2026-08-25 | industry.airliquide.kr | Air Liquide has operated in South Korea for several decades and suppli… |
| 2026-08-24 | lagegepesca.it | Based in Lallio, near Bergamo in Lombardy, the company traces its orig… |
| 2026-08-14 | granjarinya.com | Headquartered in Albal, Valencia, the family-owned company traces its … |
| 2026-08-04 | azn.co.jp | Founded in 1991, the company specializes in comprehensive asset manage… |
| 2026-08-04 | southshorerecycling.com | The company specializes in metal recycling, concrete and asphalt recyc… |
| 2026-08-04 | cpu-ag.com | Founded in 1981 and headquartered in Friedberg, Bavaria, the company h… |
| 2026-08-04 | multiaqua.com | Founded in 1999, the company specializes in the design, engineering, a… |
| 2026-08-04 | pradotuylaw.com | The firm focuses on practice areas including personal injury, wrongful… |
| 2026-08-04 | naskdoorinc.com | Headquartered in West Chester, Pennsylvania, the company has served cu… |
| 2026-08-04 | new-point.it | Headquartered in Signa, Florence, Italy, the company was founded in 20… |
| 2026-08-04 | simonrack.com | Headquartered in Alfamén, Zaragoza, Spain, the company has been manufa… |
| 2026-08-04 | hanan-hov.co.il | Headquartered in Neve Yamin, Israel, the company provides comprehensiv… |
| 2026-07-27 | haugbuersten.de | Although the company in its current industrial form was founded in 196… |
| 2026-07-27 | landesmuseum.de | Established in 1919, the museum preserves and presents more than 50,00… |
| 2026-07-27 | hst.eu | Headquartered in Kressbronn am Bodensee, Germany, the company traces i… |
| 2026-07-27 | braywoodschool.co.uk | Founded in 1858, the school has more than 165 years of educational his… |
| 2026-07-27 | weier.org | The company specializes in representing manufacturers of plumbing, hea… |
| 2026-07-27 | bnpdist.com | Headquartered in New York City, the company has been operating since 1… |
| 2026-07-27 | zinorm.de | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, t… |
| 2026-07-27 | moebelmayer.de | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, t… |
| 2026-07-27 | paritaet-nrw.org | Headquartered in Wuppertal, the organization represents approximately … |
| 2026-07-24 | upland.k12.ca.us | The district provides comprehensive education from kindergarten throug… |
| 2026-07-24 | gvsurgicalarts.com | Founded in 2004 by Dr. Brian R. Chisdak, the practice has grown into o… |
| 2026-07-20 | wdk.de | Founded in 1950 and headquartered in Frankfurt am Main, the organizati… |
| 2026-07-20 | jaecklin-industrial.de | Founded in 1935 by Julius Jäcklin, the company has developed from a re… |
| 2026-07-20 | lbb-treuhand.de | The company specializes in tax consulting, auditing, accounting, payro… |
| 2026-07-20 | timetex.de | The company traces its origins to 1991, when the TimeTEX brand was acq… |
| 2026-07-20 | stroebel-gruppe.de | Headquartered in Langenzenn, Bavaria, the company was founded in 1978 … |
| 2026-07-20 | industriesjaro.com | Over several decades, Jaro has evolved from manufacturing telephone bo… |
| 2026-07-20 | cenesco.de | Founded in 1998, the company provides comprehensive information techno… |
CONFIRMED ATTACKS
SafePay confirmed attacks: 88 verified incidents
Ransomnews has verified 88 SafePay incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2024 to August 2026. United States accounts for 34 of them (39%), with victims recorded in 16 countries in total. The most affected sector is government, at 15 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 9; the outcome is unrecorded in the remaining 79. Where a figure was disclosed (23 cases), these incidents account for 17,384,690 exposed records.
88Verified incidents
16Countries
2024–2026Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified SafePay incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Ryomo Systems Co., Ltd. | Technology | Kiryu, Japan | — | Unknown | Source |
| July 2026 | Air Liquide Korea | Manufacturing | Seoul, South Korea | — | Unknown | Source |
| July 2026 | Shuttle Meadow Country Club, Inc. | Other | Connecticut, United States | — | Unknown | Source |
| July 2026 | Hahn Airport | Transportation | Lautzenhausen, Germany | — | Unknown | Source |
| June 2026 | Badisches Landesmuseum | Government | Karlsruhe, Germany | — | Unknown | Source |
| June 2026 | AWO Berlin Kreisverband Südost e.V. | Healthcare | Berlin, Germany | — | Unknown | Source |
| June 2026 | Caritasverband Koblenz e.V. | Healthcare | Koblenz, Germany | — | Unknown | Source |
| June 2026 | Hellmold & Plank GmbH & Co. KG | Transportation | Gießen, Germany | — | Unknown | Source |
| May 2026 | Kawai America | Manufacturing | California, United States | — | Unknown | Source |
| May 2026 | Gut Heckenhof Hotel & Golfresort | Other | Eitorf, Germany | — | Unknown | Source |
| May 2026 | Matsuzawa Shoten Co., Ltd. | Retail | Tokyo, Japan | — | Unknown | Source |
| May 2026 | Aoyama Zaisan Networks Co., Ltd. (Japan Asset Research Institute Co., Ltd., Nitto Real Estate Co., Ltd.) | Service | Tokyo, Japan | — | Unknown | Source |
| April 2026 | Serveis Mèdics Penedès (SMP) | Healthcare | Barcelona, Spain | — | Unknown | Source |
| April 2026 | Soraris S.p.A. (ViAmbiente SpA) | Government | Sandrigo, Italy | — | Unknown | Source |
| April 2026 | EITECPRO Co., Ltd. | Construction | Osaka, Japan | — | Unknown | Source |
| April 2026 | Harrison County Commission | Government | West Virginia, United States | — | Unknown | Source |
| March 2026 | AcademyHealth | Healthcare | District of Columbia, United States | — | Unknown | Source |
| March 2026 | Zona Ovest di Torino S.r.l. | Government | Turin, Italy | — | Unknown | Source |
| March 2026 | Hokuyo Co., Ltd. | Finance | Toyko, Japan | — | Unknown | Source |
| March 2026 | The Navigator Company | Manufacturing | Lisbon, Portugal | — | Unknown | Source |
| March 2026 | Smile Team Orthodontics | Healthcare | Parramatta, Australia | — | Unknown | Source |
| March 2026 | Franz Sales Haus | Other | Essen, Germany | — | No | Source |
| February 2026 | Genealogy SA | Other | Adelaide, Australia | — | Unknown | Source |
| February 2026 | Abfallentsorgung Kreis Kassel | Government | Kassel, Germany | — | Unknown | Source |
| January 2026 | Superior Drywall, Inc. | Construction | Massachusetts, United States | 736 | Unknown | Source |
| December 2025 | Pell City School System | Education | Alabama, United States | — | No | Source |
| December 2025 | Usdaw (Union of Shop, Distributive and Allied Workers) | Other | Manchester, United Kingdom | — | Unknown | Source |
| December 2025 | BECKS Group Australia | Manufacturing | Ottoway, Australia | — | Unknown | Source |
| November 2025 | Harvey & Martin, PLLC | Finance | Massachusetts, United States | 24 | No | Source |
| November 2025 | 47CLUB Co., Ltd. | Food and Beverage | Tokyo, Japan | 190 | Unknown | Source |
| November 2025 | MMC Studio Köln GmbH | Other | Cologne, Germany | — | Unknown | Source |
| November 2025 | Istituto Comprensivo di Cavaglià | Education | Cavaglià, Italy | — | Unknown | Source |
| October 2025 | Glendale Obstetrics and Gynecology | Healthcare | Arizona, United States | 501 | Unknown | Source |
| October 2025 | McIntosh Laboratory, Inc. | Manufacturing | New York, United States | — | Unknown | Source |
| October 2025 | Autohaus Willy Ernst GmbH (Ernst Auto) | Retail | Coburn, Germany | — | Unknown | Source |
| October 2025 | Stadtwerke Clausthal-Zellerfeld | Government | Clausthal-Zellerfeld, Germany | — | Unknown | Source |
| October 2025 | Gemeinde Untereisesheim | Government | Untereisesheim, Germany | — | No | Source |
| October 2025 | Mino Kogyo Co., Ltd. | Manufacturing | Nakatsugawa, Japan | — | Unknown | Source |
| September 2025 | Greenhouse Apartments | Service | Massachusetts, United States | 3,473 | Unknown | Source |
| September 2025 | Gemeinde Glatten | Government | Glatten, Germany | — | Unknown | Source |
| September 2025 | The K Club | Other | Kildare, Ireland | — | No | Source |
| August 2025 | Children's Council of San Francisco | Other | California, United States | 12,655 | Unknown | Source |
| July 2025 | City of Middletown | Government | Ohio, United States | 123,791 | Unknown | Source |
| July 2025 | BARTEC Pte. | Manufacturing | Singapore, Singapore | — | Unknown | Source |
| July 2025 | Ridgefield Public Schools | Education | Connecticut, United States | — | Unknown | Source |
| July 2025 | Ingram Micro | Technology | California, United States | 42,521 | Unknown | Source |
| June 2025 | MemberSource Credit Union | Finance | Texas, United States | 31,046 | Unknown | Source |
| June 2025 | Mission City Community Network, Inc. (MCCN) | Healthcare | California, United States | 11,016 | Unknown | Source |
| June 2025 | Amt für kirchliche Dienste (AKD) | Education | Berlin, Germany | — | Unknown | Source |
| June 2025 | Cámara de Comercio de Valencia | Government | Valencia, Spain | — | No | Source |
| May 2025 | US Mortgage Corporation | Finance | New York, United States | 13,271 | Unknown | Source |
| May 2025 | Kinderzentrum Weißer Stein | Education | Wehrda, Germany | — | Unknown | Source |
| May 2025 | Tami J. Dunham, CPA | Finance | California, United States | 802 | Unknown | Source |
| May 2025 | Sedgebrook OpCo SL VII LLC | Healthcare | Illinois, United States | 7,382 | Unknown | Source |
| May 2025 | Gallivan, Gallivan & O’Melia LLC dba Digital WarRoom | Technology | Washington, United States | — | Unknown | Source |
| May 2025 | Mountain Laurel Dermatology, PLLC | Healthcare | North Carolina, United States | 3,324 | Unknown | Source |
| May 2025 | Avance Agrícola S.L. | Retail | Abarán, Spain | — | Unknown | Source |
| May 2025 | Liberty Township | Government | Ohio, United States | 600 | Unknown | Source |
| May 2025 | Payne County Sheriff's Office | Government | Oklahoma, United States | — | Unknown | Source |
| May 2025 | Gymnázium a Jazyková škola Zlín | Education | Zlín, Czechia | — | Unknown | Source |
| May 2025 | Ruddy Tomlins and Baxter (RTB Legal) | Legal | Bowen, Australia | — | Unknown | Source |
| April 2025 | Western New York Energy, LLC | Manufacturing | New York, United States | — | Unknown | Source |
| April 2025 | AWO Stadtkreis Gießen e. V. | Healthcare | Gießen, Germany | — | No | Source |
| April 2025 | Eu-Rec GmbH | Transportation | Hermeskeil, Germany | 200 | Unknown | Source |
| March 2025 | Compassion Health Care, Inc. | Healthcare | North Carolina, United States | 23,282 | Unknown | Source |
| March 2025 | Gemeinde Kirkel | Government | Kirkel, Germany | — | Unknown | Source |
| March 2025 | Suupohja Education and Employment Joint Municipal Authority - Vuoksi | Education | Kauhajoki, Finland | — | Unknown | Source |
| February 2025 | Plasser American | Manufacturing | Virginia, United States | 780 | Unknown | Source |
| February 2025 | Blunk GmbH | Service | Schleswig-Holstein, Germany | — | Unknown | Source |
| February 2025 | Argus Data Insights | Service | Zürich, Switzerland | — | Unknown | Source |
| January 2025 | Marlboro-Chesterfield Pathology, P.C. | Healthcare | North Carolina, United States | 235,911 | Unknown | Source |
| January 2025 | Willms Fleisch GmbH | Food and Beverage | Ruppichteroth, Germany | — | No | Source |
| January 2025 | Conduent Business Services, LLC | Technology | New Jersey, United States | 16,837,416 | Unknown | Source |
| January 2025 | Harrison County Board of Education | Education | West Virginia, United States | — | Unknown | Source |
| January 2025 | Bell & Graham | Legal | Matamata, New Zealand | — | Unknown | Source |
| December 2024 | Gaylord Specialty Healthcare | Healthcare | Connecticut, United States | 591 | Unknown | Source |
| December 2024 | Muscogee County School District | Education | Georgia, United States | 34,056 | Unknown | Source |
| December 2024 | Starkville-Oktibbeha Consolidated School District | Education | Mississippi, United States | — | No | Source |
| December 2024 | Muswellbrook Shire Council | Government | Muswellbrook, Australia | — | Unknown | Source |
| November 2024 | Title Nine | Retail | California, United States | 1,122 | Unknown | Source |
| November 2024 | Australian Centre for Heart Health | Healthcare | Melbourne, Australia | — | Unknown | Source |
| November 2024 | Elwood Community School Corporation | Education | Indiana, United States | — | Unknown | Source |
| November 2024 | Snow Brand Australia Pty. Ltd. | Food and Beverage | Melbourne, Australia | — | Unknown | Source |
| November 2024 | Fritz Spieth Beratende Ingenieure GmbH | Service | Esslingen, Germany | — | Unknown | Source |
| October 2024 | Triton Sourcing & Distribution | Retail | Auckland, New Zealand | — | Unknown | Source |
| October 2024 | Microlise | Technology | Nottingham, United Kingdom | — | Unknown | Source |
| October 2024 | Barbados Statistical Service (BSS) | Government | Warrens, Barbados | — | Unknown | Source |
| September 2024 | Nihonkai Construction Electric Co., Ltd. | Construction | Akita, Japan | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from SafePay's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.