Ransomware group
Safepay ransomware: victims and leak site activity
The Safepay ransomware group has listed 594 victims on its leak site since November 2024; its latest post is from 12 October 2026. Most affected countries: United States, Germany and United Kingdom. Most targeted sector: Manufacturing.
Total posts
594
First seen
2024-11-19
Latest post
2026-10-12
Countries hit
49
About Safepay
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
- Leak site (Tor)
- http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion
- Profile
- ransomware.live
Most targeted countries
- United States 217
- Germany 133
- United Kingdom 33
- Canada 32
- Italy 18
- Australia 17
- Spain 16
- Japan 12
- Argentina 11
- Switzerland 11
Most targeted sectors
- Manufacturing 103
- Professional Services 102
- Retail & E-Commerce 66
- Technology 63
- Healthcare 48
- Education 45
- Agriculture and Food Production 24
- Government & Defense 23
- Transportation 23
- Hospitality 20