Ransomware Group intelligence
Safepay
ActiveTrack Safepay with 625 published victims and 5 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Safepay is tracked by Breach House as a ransomware group with 625 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
570
- Leaked 0 0.0%
- Pending 568 99.6%
- Deleted 2 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 5 | Onion service | Down checked 4h ago | safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion |
| Leak location 4 | Onion service | Down checked 4h ago | j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion |
| Leak location 1 | Onion service | Down checked 4h ago | nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion |
| Leak location 3 | Onion service | Down checked 4h ago | nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion |
| Leak location 2 | Onion service | Down checked 4h ago | cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion |
Top Activity Sectors (16)
- Not identified 144
- Communication / Marketing 93
- Manufacturing / Engineering 56
- Services 39
- IT 31
- Construction / Real Estate 31
- Healthcare / Pharma 28
- Finance / Legal / Insurance 27
- Education 25
- Retail / E-commerce 23
- Agriculture / Food 16
- Public Sector 14
- Transportation / Travel / Logistics 14
- Hospitality / Food & Beverage / Tourism 12
- NGOs / Associations 10
- Energy 4
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.016 Junk Code Insertion Stealth
What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (8)
▼Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery
Invoke-ShareFinder
Exfiltration
FileZilla
7zip
WinRAR
LOLBAS (living-off-the-land binaries)
Regsvr32.exe
CMSTPLUA
dllhost.exe
RMM Tools
Microsoft RDP
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme_safepay.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
readme_safepay_ascii.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (625)
Search, filter and paginate the victim timeline for Safepay. Showing 401–500 of 625.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | pzsarchitects.com id20660 View details | Finland | Healthcare / Pharma | pending | ||
|
[AI generated] PZS Architects is a Philadelphia-based architectural firm that specializes in planning, interior design, and architectural design. With a commitment to sustainable design practices, the company offers a wide range of services across various sectors, including residential, commercial, cultural, educational, and healthcare. PZS Architects combines efficiency, aesthetics, and functionality in every project, aiming to enhance communities through innovative design. |
||||||
| Ransomware | welcometosedgebrook.com id20659 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | moffett-towers-club.com id20658 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | liberty-township.com id20657 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | mcsl.de id20656 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | rusindustries.com id20655 View details | Russian Federation | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | theoverheaddoorco.com id20654 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] The Overhead Door Company is a premier garage door service provider in the US, specializing in residential and commercial garage door installation, maintenance, and repair. Their product line includes a wide range of overhead and garage doors and operators, as well as related accessories. They also offer customizable designs to meet specific aesthetic or functional needs, and are known for their reliability and professional service. |
||||||
| Ransomware | awo-giessen.org id20653 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | realschule-karlstadt.org id20652 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | bristolhose.com id20651 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] "Bristol Hose & Fitting" is a company that specializes in providing high-quality industrial and hydraulic hoses, fittings, and accessories designed for a wide range of applications. The company also offers custom services to clients for specific needs. With an extensive inventory and a dedicated team, the company ensures they meet the unique requirements of each customer. |
||||||
| Ransomware | ramlaw.com id20640 View details | United States | Finance / Legal / Insurance | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | electro-seal.com id20545 View details | United States | Services | pending | ||
|
[AI generated] "Electro-Seal" specializes in inspection, maintenance and repair services for the oil and gas industry. They focus on deploying safe, efficient, and cost-effective solutions to manage asset integrity and longevity. The company offers an extensive range of services including pipeline inspections, corrosion protection, industrial coatings, and risk assessments. Their mission is to ensure continuous operation of assets by minimizing downtime and optimizing productivity. |
||||||
| Ransomware | mytaac.com id20530 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | mercercapital.com id20529 View details | United States | Services | pending | ||
|
[AI generated] Mercer Capital is a business valuation and financial advisory services firm. With expertise in providing business valuation services, this US-based company also offers financial reporting, tax compliance, corporate advisory services, and litigation support. Other services include portfolio valuation and investment banking. Their clientele is diverse, including public and private businesses, financial institutions, and high-net-worth individuals. |
||||||
| Ransomware | triangleheatingcooling.com id20528 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Triangle Heating & Cooling is a heating and cooling service provider, renowned for their commitment to high-quality work and customer satisfaction. The company operates throughout Randolph County, WV, offering various HVAC services, including installations, repairs, and maintenance of cooling, heating, and indoor air quality systems. They are dedicated to providing comfortable living environments for their clients. |
||||||
| Ransomware | Myer Auto id20420 View details | Australia | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ochsinc.org.com id20419 View details | United States | Services | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | digitalwarroom.com id20418 View details | United States | IT | pending | ||
|
[AI generated] Digital WarRoom is a software company that specializes in providing e-discovery solutions. They offer tools to investigate, process, review, mark and produce electronic documents. Their services are geared towards in-house legal teams, law firms, corporations and government institutions to aid in litigation, HR inquiries, investigations and audits. They offer both cloud-based and on-premise solutions. |
||||||
| Ransomware | universityacademy.org id20374 View details | United States | Education | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | meeksgroup.com id20359 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] The Meeks Group is an Oklahoma-based company that specializes in providing various advertising services to businesses. Their service range includes graphic design, digital printing, exterior and interior signage, promotional items, and direct mail marketing. They aim to aid businesses in enhancing their brand visibility and reaching their target audience effectively. |
||||||
| Ransomware | sfhumanesociety.org id20358 View details | United States | NGOs / Associations | pending | ||
|
[AI generated] Founded in 1868, sfhumanesociety.org is associated with the San Francisco Society for the Prevention of Cruelty to Animals (SFSPCA). As one of the world's pioneer animal welfare organizations, its mission is to save and protect animals, provide care and treatment, advocate for their welfare, and enhance the human-animal bond. It offers services including animal adoption, veterinary care, and community education. |
||||||
| Ransomware | donowentire.com id20357 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Don Owen Tire Service, Inc. is a locally owned tire and automotive service provider based in Bloomington, Illinois. Founded in 1986, the company offers tire sales and services including alignment, rotation, and flat tire repair. Additionally, they provide comprehensive auto repair and maintenance services like brake repair, oil change, and battery replacement. |
||||||
| Ransomware | iicil.com id20356 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | visco.de id20355 View details | Germany | Communication / Marketing | pending | ||
|
[AI generated] "Visco.de" is a German-based company specializing in contemporary multimedia and internet applications. Their services range from creating websites, shopping systems, catalog APPs, to digitalization and automation of business processes. With a team of competent programmers and designers, they provide individual solutions tailored to the specific needs of their customers. They also offer SEO services to increase their clients' online visibility. |
||||||
| Ransomware | buechel-online.com id20354 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ibague.losolivos.co id20335 View details | Colombia | Communication / Marketing | pending | ||
|
[AI generated] "Los Olivos" is a well-known funeral services company in Ibague, Colombia. They provide comprehensive services including funeral plans, crematorium, cemetery, wake rooms, and transportation. They also offer posthumous tributes, and psychological support to the bereaved families, showcasing their commitment to providing sensitive care during traumatic times. |
||||||
| Ransomware | Avance Agricola sl id20334 View details | Spain | Agriculture / Food | pending | ||
|
[AI generated] "Avance Agricola SL" is a Spain-based company primarily engaged in cultivation and distribution of a variety of fruits and vegetables. Spread over large agricultural area, they practice advanced farming techniques. Their produce includes, but is not limited to, fruits like pomegranates and apricots, and a diverse range of vegetables. |
||||||
| Ransomware | murraybuildingcompany.com id20333 View details | United States | Construction / Real Estate | pending | ||
|
[AI generated] Murray Building Company is an experienced construction management and general contracting firm based out of Birmingham, Alabama. They specialize in commercial construction in sectors including healthcare, retail, office, educational and industrial. Known for their commitment to quality, safety, and integrity, they offer a range of services from pre-construction planning to post-construction support. |
||||||
| Ransomware | sander-doll.com id20332 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | usmortgage.com id20331 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] USMortgage.com is a financial service provider located in the United States, specializing in home mortgages. The company offers a variety of loan products, including conventional, FHA, VA, USDA, and jumbo mortgages. It seeks to harmonize technology with customer service to streamline home financing and refinancing processes for borrowers. USMortgage.com prides itself on transparency, education, and personalized customer support. |
||||||
| Ransomware | gruposancristobal.com.mx id20313 View details | Mexico | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | radsports.com id20312 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | schoenundendres.de id20311 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | hennertanklines.com id20310 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | bridgecast.ca id20304 View details | Canada | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | codylawfirm.com id20303 View details | United States | Finance / Legal / Insurance | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | spring-green.com/petbutler.com id20302 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Spring-Green.com / PetButler.com are two distinct services operating under Spring-Green Lawn Care Corp. Spring-Green.com is a lawn care service provider that caters to the needs of residential and commercial lawns since 1977. On the other hand, PetButler.com provides professional pet waste cleanup and removal services to homeowners and community management. |
||||||
| Ransomware | paynecountyok.gov id20301 View details | United States | Public Sector | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | labbeemint.com id20260 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Labbeemint Inc. is a global trader and exporter of mint and related products. It is based in the Yakima Valley, WA, USA. They specialize in providing top-quality mint oils such as peppermint oil and spearmint oil. They are committed to achieving customer satisfaction by providing high-quality products from a sustainable and environmentally friendly business operation. |
||||||
| Ransomware | servicecentermetals.com id20259 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Service Center Metals is a leading producer of extruded aluminum products in the US, headquartered in Prince George, Virginia. The company provides a variety of aluminum billets, rods, bars, pipes, and tubes to manufacturers and service centers. It aims to deliver high-quality products with top-tier customer service, rapid lead times, and competitive prices. |
||||||
| Ransomware | ozarkah2o.com id20258 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] "Ozarkah2o.com" is the official website for Ozarka, a Texas-based company that specializes in providing bottled spring water sourced from three natural springs in Texas, USA. They also provide a home and office delivery service. Their product range includes various sizes of bottled water and refreshing flavored water. Excelled in maintaining purity, hydration, and tradition, the company emphasizes sustainable bottling practices. |
||||||
| Ransomware | gjszlin.cz id20257 View details | Czechia | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | lrcpa.com id20256 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | estudiolm.com.ar id20255 View details | Argentina | Communication / Marketing | pending | ||
|
[AI generated] "estudiolm.com.ar" is an Argentine company that specializes in innovative architectural and engineering solutions. Led by a team of highly skilled professionals, the company offers services such as planning, designing, and project management for residential, commercial, and public projects. They are well recognized for their sustainable and contemporary designs. Their mission is to create spaces that improve quality of life while maintaining a commitment to the environment. |
||||||
| Ransomware | dcbflegal.com id20250 View details | United States | Finance / Legal / Insurance | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | rtblegal.com.au id20249 View details | Australia | Finance / Legal / Insurance | pending | ||
|
[AI generated] "rtblegal.com.au" is an Australian law firm that offers a wide range of legal services. Whether it's commercial litigation, property and development law, family law, employment law, or estate planning, they promise a strategic and cost-effective approach. This experienced team is situated in South Melbourne. |
||||||
| Ransomware | notar-roemer-troisdorf.de id20176 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | rgvengineering.co.uk id20175 View details | United Kingdom | Manufacturing / Engineering | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | servicedecorating.com id20174 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ctd-dortmund.de id20173 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | planet-itservices.com id20172 View details | India | Services | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | dawg-dok.de id20171 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | proctorlane.com id20170 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | sb-p.de id20169 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | schoene-aussicht-kassel.de id20168 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | greenpac.com.sg id20116 View details | Singapore | Healthcare / Pharma | pending | ||
|
Greenpac.com.sg is the website of Greenpac (S) Pte Ltd, a Singapore-based company that designs and manufactures total packaging solutions. Its offerings focus on protective, innovative, and sustainable packaging for high-value and sensitive industrial, medical, and life-science equipment, serving clients from Singapore. The company is headquartered at 19 Tukang Innovation Drive, Singapore 618301, and presents itself as a specialist in high-mix, low-volume packaging engineered for protection, cost efficiency, and sustainability. In threat-intelligence listings, greenpac.com.sg was recorded as a ransomware victim associated with Safepay. |
||||||
| Ransomware | This entry has been removed following a request from the company. id20233 View details | Singapore | Services | pending | ||
|
Takedown notice of 26 May 2025 - Request #1201 |
||||||
| Ransomware | mylikowines.co.uk id20115 View details | United Kingdom | Retail / E-commerce | pending | ||
|
[AI generated] "Mylikowines.co.uk" is an online wine shop based in the UK that offers a selection of exquisite wines sourced from various countries. They provide an expansive collection of whites, reds, rosés, and sparkling wines. Committed to quality, they ensure each bottle fulfills high standards. Their site also has a blog that discusses various aspects of wine culture. They ship nationwide in the UK, making it easy for wine enthusiasts to access their favorite brands. |
||||||
| Ransomware | ngca.net id20114 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | distribution2.com id20113 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | redsquaredentalcare.com id20112 View details | United Kingdom | Healthcare / Pharma | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | overheadtyler.com id20111 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | clarkmechanicalinc.com id20110 View details | United States | Services | pending | ||
|
[AI generated] Clark Mechanical, Inc. is a mechanical contracting company based in California. They specialize in offering various commercial and industrial heating, ventilation, and air conditioning (HVAC) services. Their services include HVAC design, installation, repairs, and maintenance. They are dedicated to providing quality workmanship and exceptional customer service. They have been in the business for over 25 years. |
||||||
| Ransomware | prais.ro id20109 View details | Romania | Communication / Marketing | pending | ||
|
[AI generated] "Prais.ro" is a digital platform from Romania that offers access to a wide variety of services such as web design, e-commerce solutions, mobile applications, and more. They specialize in creating customized digital solutions for businesses of all sizes. Their team of experienced professionals seeks to help clients improve their online presence and expand their customer base through tailored digital strategies. |
||||||
| Ransomware | aplusmachining.com id20108 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] A Plus Machining is a US-based company that specializes in precision CNC (Computer Numerical Control) machining. They handle an assortment of metals and plastics, providing services such as milling, turning, surface grinding, and wire EDM. Known for their high-quality services, they serve industries like aerospace, automotive, medical, and more. Their customer-focused approach ensures end products meet specific needs. |
||||||
| Ransomware | freudenberg-cranes.com id20105 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | zvaonline.com id20093 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | olympusaero.com id20029 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Olympus Aero Group is an international aerospace company that specializes in sourcing and supplying aftermarket, commercial and regional aircraft engines, as well as aircraft engine material. They also provide strategic engine leasing, engine trading and engine material consignment services. Their partnerships cover a global network of airlines, maintenance providers, lessors and traders. |
||||||
| Ransomware | azpiaran.com id20028 View details | Spain | IT | pending | ||
|
Inicio | Azpiaran - The group specializes in Progressive stamping, Fine Blanking, Transfer stamping and Forming technology, azpiaran, Fine Blanking, Progressive stamping, Transfer stamping and Forming technology |
||||||
| Ransomware | wnyenergy.com id20027 View details | United States | Energy | pending | ||
|
[AI generated] WNY Energy is an energy company based in Western New York, USA. It operates a 115 million gallon per year ethanol plant that produces clean-burning, renewable fuel and various byproducts including CO2 and wet and dry distillers grain that are used in food and feed products. The company focuses on innovative technology and practices for transforming local corn into efficient, sustainable biofuels. |
||||||
| Ransomware | moorecoal.com id19979 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | igpi.co.jp id19978 View details | Japan | Services | pending | ||
|
[AI generated] IGPI (Industrial Growth Platform, Inc.) is a Tokyo-based management consulting firm. The company offers assistance in operational improvement, M&A strategies, business turnaround, and global expansion. They cater to businesses in various industries including healthcare, manufacturing, and technology. Promoting growth for their client companies is their primary aim. |
||||||
| Ransomware | kize-weisser-stein.de id19977 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | lifesafeservices.com id19976 View details | United States | Services | pending | ||
|
[AI generated] Lifesafe Services specializes in providing a comprehensive range of safety solutions to both commercial and government outlets. Their services include life-saving equipment, safety training, preventive maintenance & repair services, corporate compliance, and safety program management. They cater to various markets including education, hospitality, construction, healthcare and more. Their aim is to create a safe working environment for their clients. |
||||||
| Ransomware | gravelec.ch id19975 View details | Switzerland | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | abfiad.nl id19974 View details | Netherlands | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | join-the-quest.co.uk id19973 View details | United Kingdom | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | maxusgroup.com id19972 View details | Hong Kong | Services | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | hagemann-h.de id19971 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | metten-maas.de id19970 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | scheuerle-stuttgart.de id19969 View details | Germany | Transportation / Travel / Logistics | pending | ||
|
[AI generated] Scheuerle Stuttgart is a leading company in the heavy transport industry. Based in Stuttgart, Germany, it specializes in producing vehicles for the transportation of heavy and special loads. Their portfolio includes modular transporters, self-propelled modular transporters (SPMTs), and industrial and shipyard transporters. Scheuerle Stuttgart is globally recognized for its innovative solutions, advanced design, and robust machinery, serving various industries including construction and logistics. |
||||||
| Ransomware | gewandhaus.bayern id19968 View details | Germany | Communication / Marketing | pending | ||
|
[AI generated] "Gewandhaus.bayern" is a company based in Munich, Germany, specializing in the provision of high-end designer fashion and accessories. They offer a wide range of products from renowned luxury designers globally. Aside from physical shopping, the company also offers online services. The company promises authenticity in all its products while providing exclusive shopping experience to customers. |
||||||
| Ransomware | morricetransportation.com id19967 View details | United States | Transportation / Travel / Logistics | pending | ||
|
[AI generated] Morrice Transportation is a well-established logistics and transportation company based in Windsor, Ontario, Canada. The company provides ground freight transportation services across North America. They offer a range of services including cross-border shipping, expedited service, and hazardous materials hauling. Morrice Transport utilizes a fleet of over 300 pieces of equipment to deliver solutions for transport challenges. |
||||||
| Ransomware | eu-rec.de id19779 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | schapmann id19778 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | dosjm.com id19777 View details | Hong Kong | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | biglevel.net id19776 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | bloomfamilyeyesurgeons.com id19775 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] "Bloom Family Eye Surgeons is a leading ophthalmology practice located in Newport News, Virginia. The company focuses on providing comprehensive eye care services including eye examinations, cataract surgery, glaucoma care, diabetic eye care, contact lens fitting, and emergency eye care. The experienced team of eye surgeons and optometrists are committed to helping patients improve and maintain their vision through various advanced treatments and procedures." |
||||||
| Ransomware | kolpa.com.pe id19774 View details | Peru | Communication / Marketing | pending | ||
|
[AI generated] "Kolpa.com.pe" is an online marketplace based in Peru. They focus on promoting the sale of products from local producers and artisans throughout the country. Their range encompasses a wide variety of goods, including food, decorative items, clothing and accessories, with an emphasis on authentic, handcrafted items that showcase the diverse cultural heritage of Peru. |
||||||
| Ransomware | dreng.com id19773 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | mooregiles.com id19772 View details | United States | Healthcare / Pharma | pending | ||
|
[AI generated] Moore & Giles is a Virginia-based company specializing in the design and distribution of high-quality leather and luxury home furnishings. Founded in 1933, they collaborate with tanneries worldwide. The company not only serves the high-end residential, hospitality and aviation markets, but also offers handbags, luggage and accessories in its product line. They are known for innovative designs and commitment to environmental accountability. |
||||||
| Ransomware | itec-gmbh.com id19218 View details | Germany | Construction / Real Estate | pending | ||
|
[AI generated] ITEC GmbH is a German-based company specializing in civil engineering and construction. They offer expertise in project management, planning, supervision and construction services for both private and public sectors. Their scope of service includes roads, bridges, infrastructure and environmental development. The team’s professionals ensure compliance with safety, budgetary, and performance standards. |
||||||
| Ransomware | heinrich-steinhardt.de id19217 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | hurst-schroeder.de id19216 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | helixtools.co.uk id19215 View details | United Kingdom | Communication / Marketing | pending | ||
|
[AI generated] Helix Tools provides high-quality tooling solutions for the engineering industry. Located in the UK, the company specializes in offering a wide range of tools including, but not limited to, drill bits, end mills, threading tools, and milling tools. They pride themselves on their comprehensive selection, exceptional customer service, and competitive pricing. |
||||||
| Ransomware | heilbronn.de id19214 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | getriebetech.de id19213 View details | Germany | IT | pending | ||
|
[AI generated] "Getriebetech.de" is based in Germany and functions as a provider of exceptional transmission technology services. Their offer ranges from automatic, manual, CVT to DSG transmissions. Their team of expert engineers conduct comprehensive repairs and maintenance on these transmissions. They pride themselves on delivering quality workmanship, using cutting-edge equipment for diagnostics and resolution of complex transmission issues. They serve both private car owners and partners in the automotive industry. |
||||||
| Ransomware | kirkel.de id19212 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | extremefire.com.au id19211 View details | Australia | Communication / Marketing | pending | ||
|
[AI generated] Extreme Fire Solutions is an Australian company that specializes in fire protection services. They are experts in designing, installing, and maintaining fire safety systems. They provide a wide range of services including fire sprinkler systems, fire extinguisher supply and maintenance, fire detection and alarm systems, and fire safety training. |
||||||
| Ransomware | foerster-schwanau.de id19210 View details | Germany | Other | pending | ||
|
[AI generated] N/A |
||||||