Ransomware Group intelligence

Safepay

Active

Track Safepay with 595 published victims and 5 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 595 Known published victims in this dataset

First discovered 2024-11-19 Earliest victim discovery date

Last discovered 2026-10-12 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 217 victims

Known locations 5 Leak or negotiation infrastructure tracked

Safepay is tracked by Breach House as a ransomware group with 595 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

595

Leaked 0 0.0%
Pending 593 99.7%
Deleted 2 0.3%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 5	Onion service	Up checked 5h ago	`safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion`
Leak location 4	Onion service	Down checked 5h ago	`j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion`
Leak location 3	Onion service	Down checked 5h ago	`nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion`
Leak location 2	Onion service	Down checked 5h ago	`cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion`
Leak location 1	Onion service	Down checked 5h ago	`nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion`

Not identified 146
Communication / Marketing 94
Manufacturing / Engineering 60
Services 43
IT 36
Construction / Real Estate 31
Healthcare / Pharma 29
Finance / Legal / Insurance 27
Retail / E-commerce 25
Education 25
Agriculture / Food 17
Public Sector 14
Transportation / Travel / Logistics 14
Hospitality / Food & Beverage / Tourism 13
NGOs / Associations 10
Energy 4
null 1

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1688 Safe Mode Boot Defense Impairment

What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.

What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
T1027.016 Junk Code Insertion Stealth

What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.

What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
T1070.004 File Deletion Stealth

What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1135 Network Share Discovery Discovery

What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1491.001 Internal Defacement Impact

What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Tools Observed (8)

▼

Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery

Invoke-ShareFinder

Exfiltration

FileZilla 7zip WinRAR

LOLBAS (living-off-the-land binaries)

Regsvr32.exe CMSTPLUA dllhost.exe

RMM Tools

Microsoft RDP

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (2)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

readme_safepay.txt txt · 3019 chars

Greetings! Your corporate network was attacked by SafePay team.

Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.

It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.

We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.

Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.

Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.

We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM.

In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.

In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

Install and run Tor Browser from https://www.torproject.org/download/

Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion

Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion

Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

Our blog:

http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion

http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

Our TON blog:

tonsite://safepay.ton

You can connect through your Telegramm account.

View on RansomLook

readme_safepay_ascii.txt txt · 2999 chars

Greetings! Your corporate network was attacked by SafePay team.
Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.
It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.
We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.
Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.
Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.
We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM.
In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.
In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

Install and run Tor Browser from https://www.torproject.org/download/

Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion

Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion

Log in with ID: [snip]
Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

Our blog:

http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion

http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion

Our TON blog:
tonsite://safepay.ton

You can connect through your Telegramm account.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (595)

Search, filter and paginate the victim timeline for Safepay. Showing 1–100 of 595.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	hiqbio.com id33788 View details	2026-10-12	United States	—	pending
The company focuses on applying marine biotechnology to human health, animal health, functional foods and sustainable aquaculture. Its official website … ID 33788
Ransomware	hoteldelfinolugano.ch id33664 View details	2026-10-09	Switzerland	—	pending
The hotel was founded in 1972 and has been managed directly by the Haas family for four generations. Since 2001, … ID 33664
Ransomware	dwi-bau.de id33665 View details	2026-10-09	Germany	—	pending
The company specializes in building systems for metal roofs and facades, serving customers in the construction and building sectors. Its … ID 33665
Ransomware	dd-automation.ch id33485 View details	2026-10-05	Switzerland	Manufacturing / Engineering	pending
The company was entered into the Swiss commercial register in 1997 and specializes in electrical engineering, automation systems, conveyor technology, … ID 33485
Ransomware	stuecheli.ch id33486 View details	2026-10-05	Switzerland	Retail / E-commerce	pending
The firm was founded by architect Werner Stücheli in 1946 and has developed into a third-generation architectural practice. It is … ID 33486
Ransomware	bwi-bau.de id33487 View details	2026-10-05	Germany	Manufacturing / Engineering	pending
The organization was established in October 1964 as a subsidiary of the Construction Industry Association of North Rhine-Westphalia. It originally … ID 33487
Ransomware	halservice.it id33488 View details	2026-10-05	Italy	IT	pending
Established in 1990, the company initially focused on system integration and information-technology services and later expanded into telecommunications following the … ID 33488
Ransomware	grundens.com id33489 View details	2026-10-05	United States	Other	pending
The company's origins can be traced to 1911, when Carl A. Grundén, the son of a fisherman from Grundsund on … ID 33489
Ransomware	t-systems.com id33490 View details	2026-10-05	Germany	IT	pending
Headquartered in Germany, the company operates internationally and has locations in 26 countries, employing more than 26,000 people. T-Systems specializes … ID 33490
Ransomware	anwo.cl id33481 View details	2026-10-05	Chile	Services	pending
The company was established in 1984 by Víctor Herrmann and has developed into one of the major HVAC distribution businesses … ID 33481
Ransomware	duhaas.sk id33482 View details	2026-10-05	Slovakia	Services	pending
The company was subsequently transformed into a limited liability company in 1992 and established as a joint-stock company in 1994. … ID 33482
Ransomware	ikhasas.com id33483 View details	2026-10-05	Malaysia	IT	pending
The group was incorporated as iKHASAS Sdn. Bhd. in 2008 and subsequently expanded beyond construction into property development, hospitality, plantation, … ID 33483
Ransomware	sterrer.net id33484 View details	2026-10-05	Netherlands	IT	pending
The company has operated since 1979 and combines agricultural production with technical services for commercial poultry farms. Its activities include … ID 33484
Ransomware	wolfusofsky.de id33356 View details	2026-09-30	Germany	Services	pending
The group provides a broad range of construction and infrastructure services to public and private clients in Rhineland-Palatinate, Saarland, neighboring … ID 33356
Ransomware	econ-tec.com id33337 View details	2026-09-30	Germany	Services	pending
The company focuses on designing technical systems for industrial customers, combining engineering expertise with process optimization, automation and energy-efficient production … ID 33337
Ransomware	assist2enjoy.be id33338 View details	2026-09-30	Belgium	null	pending
The company was established in 2015 and operates primarily in the wholesale and retail market for electrical household appliances. Its … ID 33338
Ransomware	manno.ch id33234 View details	2026-09-28	Switzerland	IT	pending
The official website, manno.ch, provides residents, businesses and visitors with information about municipal administration, public services, local regulations, infrastructure, cultural … ID 33234
Ransomware	auromex.com id33235 View details	2026-09-28	Mexico	Manufacturing / Engineering	pending
The company is headquartered in Samut Prakan Province and has more than five decades of experience in the surface-finishing industry. … ID 33235
Ransomware	cromados.com id33236 View details	2026-09-28	Spain	Manufacturing / Engineering	pending
The company's registered business activities include thermal treatment of metals, organic and electrolytic coatings, and the manufacture and commercialization of … ID 33236
Ransomware	lfgholding.com id33227 View details	2026-09-28	Switzerland	Other	pending
The company operates as an independent, partner-owned wealth-management group and manages a portfolio of specialized financial-services businesses. Its operating companies … ID 33227
Ransomware	fedelmundo.com.ph id33228 View details	2026-09-28	Philippines	Communication / Marketing	pending
The institution traces its origins to 1957, when Filipino pediatrician and scientist Dr. Fe del Mundo established Children's Memorial Hospital … ID 33228
Ransomware	bio-strath.com id33229 View details	2026-09-28	Switzerland	Healthcare / Pharma	pending
The company was established in 1961 and operates the Bio-Strath brand, which is particularly associated with liquid and tablet nutritional … ID 33229
Ransomware	sumperk.cz id33230 View details	2026-09-28	Czechia	Retail / E-commerce	pending
The official website, sumperk.cz, serves as the city's principal digital information and service portal for residents, businesses, visitors and other … ID 33230
Ransomware	eagroep.com id33231 View details	2026-09-28	Belgium	Agriculture / Food	pending
The group is headquartered in Deventer, Overijssel, and brings together several specialized business units operating in areas such as career … ID 33231
Ransomware	Holiday Inn Vilnius id33232 View details	2026-09-28	Lithuania	Hospitality / Food & Beverage / Tourism	pending
The property operates under the international Holiday Inn brand of IHG Hotels & Resorts. The hotel provides 134 guest rooms, … ID 33232
Ransomware	marlinhvac.com id32878 View details	2026-09-15	United States	Services	pending
Founded in 1989 by Michael and Richard Pellino, the company has developed more than three decades of experience in mechanical … ID 32878
Ransomware	neumerkel-gmbh.de id32879 View details	2026-09-15	Germany	Manufacturing / Engineering	pending
The business traces its origins to 1963 and has operated under the Neumerkel GmbH name since 1994. Its product portfolio … ID 32879
Ransomware	triniticaring.org id32880 View details	2026-09-15	United States	NGOs / Associations	pending
The organization is jointly owned by Guardian Angels Senior Services of Elk River and Cassia, an Augustana/Elim affiliation. Its headquarters … ID 32880
Ransomware	laconcepcion.com.mx id32881 View details	2026-09-15	Mexico	Agriculture / Food	pending
The organization identifies itself as one of the principal private healthcare providers in the region and serves patients from Coahuila … ID 32881
Ransomware	meterex.com id32882 View details	2026-09-15	Germany	Manufacturing / Engineering	pending
The company is headquartered in Langenfeld, North Rhine-Westphalia, and is legally registered as Karl Kuntze (GmbH & Co.), HRA 16336 … ID 32882
Ransomware	stoecklin-kuechen.ch id32883 View details	2026-09-15	Switzerland	Retail / E-commerce	pending
The company is based in Aesch near Basel and has developed from a traditional carpentry business founded by Ernst Stöcklin … ID 32883
Ransomware	ryomo.co.jp id32884 View details	2026-09-15	Japan	IT	pending
Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … ID 32884
Ransomware	ara-lyss.ch id32885 View details	2026-09-15	Switzerland	—	pending
Its headquarters and main wastewater-treatment facility are located at Industriering 28 in Lyss. The organization also operates the ARA Messen … ID 32885
Ransomware	gob.pe id32886 View details	2026-09-15	Peru	Public Sector	pending
It serves as the country's primary online point of contact between public institutions and citizens, providing government information, administrative procedures, … ID 32886
Ransomware	compunnel.com id32763 View details	2026-09-11	United States	IT	deleted
The company provides a combination of talent acquisition, IT consulting, digital engineering, artificial intelligence, cybersecurity, and workforce management services to … ID 32763
Ransomware	palmettoeyeinstitute.com id32693 View details	2026-09-08	United States	Healthcare / Pharma	pending
The practice was founded by Dr. Prat Itharat, a board-certified ophthalmologist who specializes in cataract surgery and comprehensive eye care. … ID 32693
Ransomware	reichenau.at id32694 View details	2026-09-08	Austria	IT	pending
The official website, reichenau.at, serves as the municipality's central digital information and service platform for residents, businesses, and visitors. The … ID 32694
Ransomware	cannonpuntana.com id32695 View details	2026-09-08	Argentina	Retail / E-commerce	pending
The company operated in Argentina and was historically connected with the manufacture and distribution of fragrances, toiletries, and personal-care products. … ID 32695
Ransomware	assiprime.it id32696 View details	2026-09-08	Italy	Healthcare / Pharma	pending
The company provides insurance brokerage, risk-management, financial consulting, and related assistance services to private individuals, businesses, professionals, artisans, and commercial … ID 32696
Ransomware	gayafores.es id32697 View details	2026-09-08	Spain	Retail / E-commerce	pending
The company is headquartered in Onda, Castellón, one of Europe's most important ceramic manufacturing regions. Established in 1949, Gayafores has … ID 32697
Ransomware	cenmar-manila.com id32698 View details	2026-09-08	Philippines	Services	pending
The company was registered with the Philippine Securities and Exchange Commission in 1997 and received authorization to operate as a … ID 32698
Ransomware	gsngestion.es id32699 View details	2026-09-08	Spain	IT	pending
The company is based in Villaviciosa de Odón, Madrid, and operates through the GSN Gestión brand. Its website states that … ID 32699
Ransomware	hbpro.pt id32700 View details	2026-09-08	Portugal	Services	pending
Established in 1994, the company has more than three decades of experience providing technology products, infrastructure, consulting, maintenance, and technical … ID 32700
Ransomware	recoverycafe.org id32691 View details	2026-09-08	United States	NGOs / Associations	pending
The organization was founded in 2003 and opened its first physical café in Seattle in 2004. Its approach is based … ID 32691
Ransomware	mcnishsteel.com id32692 View details	2026-09-08	Canada	Manufacturing / Engineering	pending
The company is headquartered in Edmonton, Alberta, and was founded in 1978 by William and Wallace McNish. It has developed … ID 32692
Ransomware	industry.airliquide.kr id32128 View details	2026-08-25	Korea, Republic of	Manufacturing / Engineering	pending
Air Liquide has operated in South Korea for several decades and supplies essential gases and related technologies to major industries, … ID 32128
Ransomware	lagegepesca.it id32085 View details	2026-08-24	Italy	Agriculture / Food	pending
Based in Lallio, near Bergamo in Lombardy, the company traces its origins to 1957, when Santo Gavazzi established a small … ID 32085
Ransomware	granjarinya.com id31721 View details	2026-08-14	Spain	Agriculture / Food	pending
Headquartered in Albal, Valencia, the family-owned company traces its origins to three generations of livestock farming. What began as a … ID 31721
Ransomware	pradotuylaw.com id31191 View details	2026-08-03	United States	Finance / Legal / Insurance	pending
The firm focuses on practice areas including personal injury, wrongful death, workplace harassment, business litigation, civil settlements, and environmental litigation. … ID 31191
Ransomware	naskdoorinc.com id31192 View details	2026-08-03	United States	IT	pending
Headquartered in West Chester, Pennsylvania, the company has served customers throughout southeastern Pennsylvania and northern Delaware for several decades. Although … ID 31192
Ransomware	new-point.it id31193 View details	2026-08-03	Italy	IT	pending
Headquartered in Signa, Florence, Italy, the company was founded in 2006 and has grown into one of Italy's established suppliers … ID 31193
Ransomware	simonrack.com id31194 View details	2026-08-03	Spain	IT	pending
Headquartered in Alfamén, Zaragoza, Spain, the company has been manufacturing metal shelving since 1964 and has become one of Europe's … ID 31194
Ransomware	hanan-hov.co.il id31195 View details	2026-08-03	Israel	Construction / Real Estate	deleted
Headquartered in Neve Yamin, Israel, the company provides comprehensive logistics support for construction, infrastructure, industrial, and commercial projects throughout the … ID 31195
Ransomware	azn.co.jp id31185 View details	2026-08-03	Japan	Manufacturing / Engineering	pending
Founded in 1991, the company specializes in comprehensive asset management, inheritance planning, business succession consulting, real estate advisory services, and … ID 31185
Ransomware	southshorerecycling.com id31186 View details	2026-08-03	United States	Manufacturing / Engineering	pending
The company specializes in metal recycling, concrete and asphalt recycling, aggregate production, and construction waste processing for commercial, industrial, and … ID 31186
Ransomware	cpu-ag.com id31187 View details	2026-08-03	Germany	IT	pending
Founded in 1981 and headquartered in Friedberg, Bavaria, the company has more than four decades of experience developing specialized software … ID 31187
Ransomware	multiaqua.com id31188 View details	2026-08-03	United States	Agriculture / Food	pending
Founded in 1999, the company specializes in the design, engineering, and production of air-cooled water chillers, heat pump chillers, hydronic … ID 31188
Ransomware	zinorm.de id30991 View details	2026-07-27	Germany	IT	pending
Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … ID 30991
Ransomware	moebelmayer.de id30992 View details	2026-07-27	Germany	Retail / E-commerce	pending
Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … ID 30992
Ransomware	paritaet-nrw.org id30993 View details	2026-07-27	Germany	NGOs / Associations	pending
Headquartered in Wuppertal, the organization represents approximately 3,100 legally independent member organizations operating more than 7,000 social institutions and services … ID 30993
Ransomware	haugbuersten.de id30994 View details	2026-07-27	Germany	Manufacturing / Engineering	pending
Although the company in its current industrial form was founded in 1962, its family-owned brush-making tradition dates back to 1836, … ID 30994
Ransomware	landesmuseum.de id30995 View details	2026-07-27	Germany	Public Sector	pending
Established in 1919, the museum preserves and presents more than 50,000 years of human cultural history, ranging from prehistoric artifacts … ID 30995
Ransomware	hst.eu id30996 View details	2026-07-27	Germany	—	pending
Headquartered in Kressbronn am Bodensee, Germany, the company traces its mechanical engineering heritage back to 1950, while the original tea … ID 30996
Ransomware	braywoodschool.co.uk id30997 View details	2026-07-27	United Kingdom	—	pending
Founded in 1858, the school has more than 165 years of educational history and serves children from early years through … ID 30997
Ransomware	weier.org id30985 View details	2026-07-27	Germany	Other	pending
The company specializes in representing manufacturers of plumbing, heating, water treatment, pumping, drainage, and building services equipment throughout western Germany. … ID 30985
Ransomware	bnpdist.com id30986 View details	2026-07-27	United States	Finance / Legal / Insurance	pending
Headquartered in New York City, the company has been operating since 1979 and supplies restaurants, hotels, retailers, and wine merchants … ID 30986
Ransomware	upland.k12.ca.us id30831 View details	2026-07-24	United States	Education	pending
The district provides comprehensive education from kindergarten through twelfth grade and operates 14 schools, including elementary, junior high, and high … ID 30831
Ransomware	gvsurgicalarts.com id30832 View details	2026-07-24	United States	Healthcare / Pharma	pending
Founded in 2004 by Dr. Brian R. Chisdak, the practice has grown into one of Montana's leading surgical centers and … ID 30832
Ransomware	wdk.de id30710 View details	2026-07-20	Germany	Finance / Legal / Insurance	pending
Founded in 1950 and headquartered in Frankfurt am Main, the organization serves as the central voice of German manufacturers of … ID 30710
Ransomware	jaecklin-industrial.de id30711 View details	2026-07-20	Germany	Manufacturing / Engineering	pending
Founded in 1935 by Julius Jäcklin, the company has developed from a regional machine repair workshop into a globally recognized … ID 30711
Ransomware	lbb-treuhand.de id30712 View details	2026-07-20	Germany	Finance / Legal / Insurance	pending
The company specializes in tax consulting, auditing, accounting, payroll administration, financial reporting, and business advisory services for private individuals, self-employed … ID 30712
Ransomware	timetex.de id30713 View details	2026-07-20	Germany	Manufacturing / Engineering	pending
The company traces its origins to 1991, when the TimeTEX brand was acquired and expanded into a comprehensive supplier of … ID 30713
Ransomware	stroebel-gruppe.de id30714 View details	2026-07-20	Germany	Manufacturing / Engineering	pending
Headquartered in Langenzenn, Bavaria, the company was founded in 1978 by Gerlinde and Gerhard Ströbel and has grown from a … ID 30714
Ransomware	industriesjaro.com id30715 View details	2026-07-20	Canada	Manufacturing / Engineering	pending
Over several decades, Jaro has evolved from manufacturing telephone booths into a supplier of advanced outdoor enclosures, interactive kiosks, bus … ID 30715
Ransomware	cenesco.de id30716 View details	2026-07-20	Germany	IT	pending
Founded in 1998, the company provides comprehensive information technology solutions for small and medium-sized enterprises (SMEs), helping organizations modernize their … ID 30716
Ransomware	acsmallmaxwell.com.au id30717 View details	2026-07-20	Australia	Finance / Legal / Insurance	pending
Founded in 1916 by Ambrose Cecil Small, the firm has provided professional accounting and financial services to businesses and individuals … ID 30717
Ransomware	mende-grundbesitz.de id30718 View details	2026-07-20	Germany	Construction / Real Estate	pending
Founded in 1994, the company specializes in the professional administration of residential, commercial, and mixed-use real estate throughout the Berlin … ID 30718
Ransomware	shuttlemeadowcc.com id30525 View details	2026-07-13	United States	Transportation / Travel / Logistics	pending
Founded in 1917, the club is one of the oldest and most prestigious private golf clubs in New England. It … ID 30525
Ransomware	matrixwebagency.com id30296 View details	2026-07-06	United States	Communication / Marketing	pending
The company specializes in providing integrated digital solutions that help businesses improve their online visibility, customer engagement, and revenue growth. … ID 30296
Ransomware	bmiprojects.de id30297 View details	2026-07-06	Germany	Construction / Real Estate	pending
Originally operating under the name Bez Marine Interiors GmbH, the company built on decades of experience in the maritime industry … ID 30297
Ransomware	caritas-koblenz.de id30298 View details	2026-07-06	Germany	NGOs / Associations	pending
Headquartered in Koblenz, the association was founded in 1918 and has provided charitable and community-based services for more than a … ID 30298
Ransomware	knobel-bau.de id30299 View details	2026-07-06	Germany	Construction / Real Estate	pending
Founded in 1947, the company has grown from a small sand and gravel business established after the Second World War … ID 30299
Ransomware	rtngmbh.de id30300 View details	2026-07-06	Germany	IT	pending
Founded in 2015, the company specializes in the construction, installation, maintenance, and rehabilitation of underground utility networks and civil engineering … ID 30300
Ransomware	stedwardscatholicfirstschool.co.uk id30301 View details	2026-07-06	United Kingdom	Education	pending
The school provides education for children aged 5 to 9 years and operates as a Voluntary Aided School under the … ID 30301
Ransomware	lh-wohnverbund-wohnen-nrw.de id30302 View details	2026-07-06	Germany	Construction / Real Estate	pending
They specialize in providing residential care, supported living, and social assistance for children, adolescents, and adults with intellectual and developmental … ID 30302
Ransomware	shw-fr.de id30303 View details	2026-07-06	Germany	Manufacturing / Engineering	pending
The company traces its origins to 1596, making it one of Germany's oldest industrial manufacturers, although its current corporate structure … ID 30303
Ransomware	hahn-airport.de id30295 View details	2026-07-06	Germany	Transportation / Travel / Logistics	pending
Originally developed as a United States military air base, the facility began civilian operations in 1993 and has since become … ID 30295
Ransomware	awo-suedost.de id30165 View details	2026-07-01	Germany	NGOs / Associations	pending
Established in 1994, it is one of the regional branches of the Arbeiterwohlfahrt (AWO), one of Germany's six largest independent … ID 30165
Ransomware	dia179.com id30166 View details	2026-07-01	Germany	Other	pending
Founded in 2007, the firm specializes in industrial architecture, logistics facilities, research centers, production plants, and corporate office buildings. Unlike … ID 30166
Ransomware	eaglecrestlife.org id30167 View details	2026-07-01	United States	NGOs / Associations	pending
Operating under Bethany Lutheran Homes, Inc., the organization has served the region since 1946 and is recognized as the largest … ID 30167
Ransomware	hellmold-plank.de id30048 View details	2026-06-27	Germany	Manufacturing / Engineering	pending
Founded in 1904 by Heinrich Hellmold and Heinrich Plank, the company has evolved from a local cartage business into a … ID 30048
Ransomware	ehg.bayern id30090 View details	2026-06-22	Germany	Other	pending
Founded in 1991, the company has evolved from a regional waste management enterprise into a specialized provider of infrastructure operations, … ID 30090
Ransomware	seinordovest.it id29951 View details	2026-06-17	Italy	Services	pending
Headquartered in the Piedmont region, the company operates as a public utility serving numerous municipalities in northwestern Italy. Its mission … ID 29951
Ransomware	harcourts.net id29952 View details	2026-06-17	Australia	Construction / Real Estate	pending
Founded in 1888 in Wellington, New Zealand, the company has grown from a local real estate agency into a global … ID 29952
Ransomware	zaunsysteme.de id29953 View details	2026-06-17	Germany	Manufacturing / Engineering	pending
Operating within Germany’s construction materials and perimeter security sector, the company provides a wide range of products, including double-wire mesh … ID 29953
Ransomware	brscappuccio.it id29954 View details	2026-06-17	Italy	Hospitality / Food & Beverage / Tourism	pending
Headquartered in Casandrino, near Naples in the Campania region, the company specializes in the distribution and supply of medical devices, … ID 29954
Ransomware	gut-heckenhof.de id29955 View details	2026-06-17	Germany	Agriculture / Food	pending
Established in 1992, the company operates a four-star hotel and one of the largest golf facilities in the region. The … ID 29955
Ransomware	hughstirling.co.uk id29899 View details	2026-06-15	Germany	Construction / Real Estate	pending
Headquartered in Goslar, Lower Saxony, the firm has been operating since 1975 and has expanded its presence through additional offices … ID 29899
Ransomware	tokyocivil.co.jp id29900 View details	2026-06-15	Japan	Construction / Real Estate	pending
Established in 2020, the company specializes in public infrastructure and civil engineering projects, serving primarily the Tokyo metropolitan area and … ID 29900
Ransomware	kawaius.com id29901 View details	2026-06-15	United States	IT	pending
Founded in Japan in 1927 by Koichi Kawai, the company has established a reputation for combining traditional Japanese craftsmanship with … ID 29901

Safepay

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (5)

Top Activity Sectors (17)