1. Executive summary On 2026-11-02 the ransomware leak-site index ransomware.live recorded a listing in which the group calling itself safepay names deom.
1. Executive summary CISA, the FBI, the US Secret Service and international partners issued a joint advisory on SafePay, a ransomware group they describe as one
1. Executive summary A ransomware group operating under the name "safepay" listed dwi-bau.de, a German construction-sector company specialising in metal roof
1. Executive summary The ransomware.live leak index lists t-systems.com as a victim of a group calling itself "safepay", posted 2026-10-
1. Executive summary On 2026-10-05 the ransomware leak site index ransomware.live recorded a victim posting by a group calling itself "safepay"
1. Executive summary The ransomware group tracked as "safepay" listed halservice.it, an Italian system-integration and telecommunications provider established in 1990, on its
1. Executive summary Ransomware.live recorded a public claim attributed to Safepay that names the German domain wolfusofsky.de as a victim. The supplied source does
1. Executive summary The ransomware leak site aggregator ransomware.live listed econ-tec.com, a German industrial engineering firm, as a victim of a group calling
1. Executive summary On 2026-09-15, the ransomware leak-site index ransomware.live recorded the victim neumerkel-gmbh.de (Germany) as posted by a group
1. Executive summary On 2026-09-15, the ransomware leak-site indexer ransomware.live recorded a victim posting by a group calling itself "safepay"
1. Executive summary On 2026-09-08, the ransomware operator "safepay" listed the Spanish firm GSN Gestión (gsngestion.es, Villaviciosa de Odón, Madrid) as
1. Executive summary On 2026-09-08, the ransomware operator "safepay" publicly listed the Portuguese company hbpro.pt as a victim on its leak