> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware: safepay named halservice.it (IT) - URL: https://f4n6.co.uk/security-feed/ransomware-safepay-named-halservice-it-it/ - Published: 2026-10-06T08:38:46.000Z - Updated: 2026-10-06T08:38:46.000Z - Author: Jeff Davies - Tags: #security-feed, SafePay ## 1\. Executive summary The ransomware group tracked as "safepay" listed halservice.it, an Italian system-integration and telecommunications provider established in 1990, on its leak site on 2026-10-05\. The listing is one of at least six safepay victims indexed across Italy, Portugal and Germany, including T-Systems (t-systems.com), which indicates the group is targeting IT service providers and their downstream SME clients rather than a single sector. No CVE, initial-access vector, malware sample or atomic indicator is present in the source material, so the intrusion mechanism is unknown and no exploitation state can be confirmed. The risk to EMEA financial services is indirect but material: halservice.it and the other named victims are exactly the kind of managed-service and integration suppliers that sit inside regulated firms' ICT third-party chains, and a ransomware event at such a supplier can interrupt client services without the client's own estate being touched. Attribution to "safepay" rests on the leak-site listing alone; the group has no MITRE ATT&CK profile in our reference data and the attribution is unconfirmed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | A named safepay victim set includes IT service providers and integrators (halservice.it, t-systems.com, cpu-ag.com, cenesco.de, hbpro.pt) that plausibly appear in financial entities' supplier registers | Clients must confirm whether any named victim is a direct or nth-party ICT provider and, if so, treat the listing as a third-party risk event requiring the contractual and monitoring response already owed under Art. 28 | | DORA Art. 30: key contractual provisions with ICT third-party providers | Same supplier exposure; the source gives no breach confirmation, so the trigger is the listing, not a proven outage | Where a named victim is a contracted provider, check whether the contract carries the incident-notification and cooperation clauses Art. 30 requires, and whether the provider has notified | | NIS2 Art. 21(2)(d): supply chain security measures | The victim set is dominated by IT service and integration suppliers, the supply-chain exposure Art. 21(2)(d) addresses | In-scope entities should verify supplier security posture for any named victim in their chain; this is a supply-chain measure, not an incident report | No DORA Art. 17, 18, 19 or 24 obligation is engaged on the facts available: the source does not confirm that any client's own ICT systems were affected, so there is no incident to classify, manage or report. NIS2 Art. 23 and the UK NIS 2018 OES/RDSP duties are likewise not triggered by a third-party leak-site listing absent confirmed impact on the client's own service delivery. If a client confirms that a named victim is its provider and that service was disrupted, Art. 17, 18 and 19 come into scope at that point. ## 3\. Technical analysis & attack chain The source material does not support an attack chain. What is confirmed is the listing itself and the victim profile. 1. safepay posted halservice.it to its leak site on 2026-10-05, with country IT and website halservice.it. 2. The same group's indexed victim set includes assiprime.it (IT, insurance brokerage and risk-management services), new-point.it (IT, Signa, Florence), hbpro.pt (PT, technology products and infrastructure), cenesco.de (DE, SME IT solutions), t-systems.com (DE, international IT services, 26 countries, 26,000+ staff) and cpu-ag.com (DE, Friedberg, Bavaria, specialised software). No initial-access vector, exploited component, CVE, payload, persistence mechanism, command-and-control channel, lateral-movement technique, exfiltration method or impact detail is present in any of the sources. The listing does not state whether data was exfiltrated, whether encryption occurred, or whether a ransom demand was made. Do not infer ransomware encryption from the group's categorisation alone; the source establishes a leak-site listing, nothing more. Two data points from the halservice.it page are worth recording with a caveat. The page reports "Compromised Users: 10", "Compromised Employees: 0", "Third Party Employee Credentials: 0" and "External Attack Surface: 4". These fields are populated by the indexing platform, not by the operator, and the source does not explain how they were derived. Treat them as unverified platform metadata, not as confirmed credential exposure. The page also carries a "Leak Screenshot" field, but no screenshot content, file listing or sample is reproduced in the material available to us. Confidence caveat: every fact in this section is single-sourced to ransomware.live, a leak-site indexing platform. The platform republishes operator claims without verifying them. We have not independently confirmed that halservice.it suffered a ransomware event, that any data was taken, or that safepay is the responsible group. The victim-set pattern (multiple IT service providers across three countries) is the only analytical signal, and it is a pattern in a single index, not corroborated reporting. ## 4\. Mitigation & containment P1 (within 24 hours) - Determine whether halservice.it, assiprime.it, new-point.it, hbpro.pt, cenesco.de, t-systems.com or cpu-ag.com appears anywhere in your supplier register, including as a subcontractor or nth party. The victim set is the actionable output of this item; the technical detail is not. - For any confirmed relationship, contact the provider through a known-good channel (not a link or address from the leak site) and ask directly whether service is affected and whether client data is in scope. Do not rely on the provider's public status page alone. - If a named provider supplies a service on your critical or important function list, pre-position the fallback: confirm whether an alternate provider or internal capability can carry the function, and how long the switch takes. P2 (within 72 hours) - Review the incident-notification and audit-rights clauses in contracts with any named provider against DORA Art. 30 expectations, and record where the contract is silent. - For any named provider with remote access into your environment (VPN, RMM agent, support tunnel), enumerate the access paths and confirm they are least-privilege and MFA-gated. A supplier compromise is an access path into your estate. - Pull authentication logs for the last 30 days for any account, service principal or API key tied to a named provider and look for access from unexpected source addresses or outside contracted support hours. P3 (within 7 days) - Add the named victim domains to third-party risk monitoring so any future listing or status change is caught without manual review. - Where a named provider is in your supply chain, request its current patching and backup posture in writing. The source gives no vulnerability to patch, so the remediation here is supplier assurance, not a version bump. No vendor fix, patch or version pin applies to this item: the source names no product, version or CVE. ## 5\. Indicators of compromise No atomic indicators of compromise (hashes, domains, IPs, file paths, registry keys) are present in the source material. The only machine-usable values are the victim domains, which are the targets, not attacker infrastructure, and are listed here for supplier-matching rather than blocking. | type | value | confidence | source | | ------------- | ----------------- | -------------------------- | ------------------------------ | | victim-domain | halservice\[.\]it | confirmed as listed victim | ransomware.live (primary item) | | victim-domain | assiprime\[.\]it | confirmed as listed victim | ransomware.live (corpus-1) | | victim-domain | new-point\[.\]it | confirmed as listed victim | ransomware.live (corpus-2) | | victim-domain | hbpro\[.\]pt | confirmed as listed victim | ransomware.live (corpus-3) | | victim-domain | cenesco\[.\]de | confirmed as listed victim | ransomware.live (corpus-4) | | victim-domain | t-systems\[.\]com | confirmed as listed victim | ransomware.live (corpus-5) | | victim-domain | cpu-ag\[.\]com | confirmed as listed victim | ransomware.live (corpus-6) | These are legitimate victim organisations, not malicious infrastructure. Do not block them; use them to query your supplier register. ```iocs victim-domain halservice[.]it victim-domain assiprime[.]it victim-domain new-point[.]it victim-domain hbpro[.]pt victim-domain cenesco[.]de victim-domain t-systems[.]com victim-domain cpu-ag[.]com ``` Behavioural indicators: none available. The source describes no authentication pattern, device registration, process activity or network behaviour. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, ransom-note text or hard-coded values. The only strings present are victim domain names and the group label "safepay", neither of which is an artefact of the malware or the intrusion. A rule built on them would detect reporting about the event, not the event. We will not emit one. ## 7\. Sources - ransomware.live, "Ransomware: safepay named halservice.it (IT)", https://www.ransomware.live/id/aGFsc2VydmljZS5pdEBzYWZlcGF5, published 2026-10-05 - ransomware.live, "Ransomware: safepay named assiprime.it (IT)", https://www.ransomware.live/id/YXNzaXByaW1lLml0QHNhZmVwYXk= - ransomware.live, "Ransomware: safepay named new-point.it (IT)", https://www.ransomware.live/id/bmV3LXBvaW50Lml0QHNhZmVwYXk= - ransomware.live, "Ransomware: safepay named hbpro.pt (PT)", https://www.ransomware.live/id/aGJwcm8ucHRAc2FmZXBheQ== - ransomware.live, "Ransomware: safepay named cenesco.de (DE)", https://www.ransomware.live/id/Y2VuZXNjby5kZUBzYWZlcGF5 - ransomware.live, "Ransomware: safepay named t-systems.com (DE)", https://www.ransomware.live/id/dC1zeXN0ZW1zLmNvbUBzYWZlcGF5 - ransomware.live, "Ransomware: safepay named cpu-ag.com (DE)", https://www.ransomware.live/id/Y3B1LWFnLmNvbUBzYWZlcGF5 ## 8\. Adverse Trace position Adverse Trace assesses this as a low-severity item for most clients and a potentially high-severity item for any client that contracts one of the named providers. The listing itself carries no exploitable technical detail, no CVE and no indicator set, so there is nothing to patch or block. The signal is the victim profile: safepay's indexed set is weighted toward IT service providers and integrators across Italy, Portugal and Germany, and T-Systems in particular is large enough that its presence on the list warrants scrutiny of the group's targeting logic. We treat the attribution to safepay as unconfirmed, because the group has no MITRE ATT&CK profile in our reference data and the only evidence is the operator's own leak-site claim, republished by a single indexing platform. We will monitor for a safepay ATT&CK profile or independent vendor reporting that corroborates the group's tooling and initial-access pattern, and we will re-issue if a named victim is confirmed as a provider to our client base. Clients should action the P1 supplier-register query now; that is the only step this item supports. --- [Read the original source →](https://www.ransomware.live/id/aGFsc2VydmljZS5pdEBzYWZlcGF5?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*