Ransomware group
Safepay ransomware: victims and leak site activity
The Safepay ransomware group has listed 559 victims on its leak site since November 2024; its latest post is from 8 September 2026. Most affected countries: United States, Germany and United Kingdom. Most targeted sector: Manufacturing.
Total posts
559
First seen
2024-11-19
Latest post
2026-09-08
Countries hit
47
About Safepay
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Most targeted countries
- United States 212
- Germany 126
- United Kingdom 33
- Canada 32
- Australia 17
- Italy 17
- Spain 15
- Argentina 11
- Japan 11
- Mexico 7
Most targeted sectors
- Manufacturing 99
- Professional Services 99
- Retail & E-Commerce 61
- Technology 57
- Education 45
- Healthcare 45
- Agriculture and Food Production 23
- Transportation 23
- Government & Defense 22
- Hospitality 18