SafePay
Data as of August 16, 2026.
Credential exposure before the attack
20.5% of SafePay victims whose domain we can identify (114 of 555) had employee credentials leak in the 12 months before SafePay named them as a victim.
We don't know whether any of these credentials were how SafePay gained initial access.
What industries SafePay targets
Sector identified for 357 of 555 victims.
| Manufacturing | 85 | |
| Construction | 48 | |
| Healthcare | 42 | |
| Education | 40 | |
| Logistics | 26 | |
| Financial Services | 25 | |
| Non-profit | 15 | |
| Retail | 13 |
Where the victims are located
Country identified for 373 of 555 victims.
| Germany | 106 | |
| United States | 96 | |
| United Kingdom | 30 | |
| Canada | 29 | |
| Italy | 17 | |
| Australia | 12 | |
| Japan | 11 | |
| Spain | 11 |
Most recent SafePay victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Aoyama Zaisan Networks azn.co.jp | Financial Services | Japan | Aug 4, 2026 |
| CPU Softwarehouse cpu-ag.com | Financial Services | Germany | Aug 4, 2026 |
| Hanan Transport & Cranes hanan-hov.co.il | Logistics | Israel | Aug 4, 2026 |
| Multiaqua multiaqua.com | Manufacturing | United States | Aug 4, 2026 |
| Nask Door naskdoorinc.com | Not identified | United States | Aug 4, 2026 |
| New Point new-point.it | Not identified | Italy | Aug 4, 2026 |
| Prado & Tuy pradotuylaw.com | Legal | United States | Aug 4, 2026 |
| SimonRack simonrack.com | Manufacturing | Spain | Aug 4, 2026 |
| South Shore Recycling & Crushing southshorerecycling.com | Construction | United States | Aug 4, 2026 |
| BNP Distributing bnpdist.com | Not identified | United States | Jul 28, 2026 |
| Braywood Church of England First School braywoodschool.co.uk | Education | United Kingdom | Jul 28, 2026 |
| Haug Bürsten haugbuersten.de | Manufacturing | Germany | Jul 28, 2026 |
| HST Packing Machines hst.eu | Manufacturing | Germany | Jul 28, 2026 |
| Badisches Landesmuseum landesmuseum.de | Not identified | Germany | Jul 28, 2026 |
| Möbel Mayer moebelmayer.de | Retail | Germany | Jul 28, 2026 |
| Der Paritätische NRW paritaet-nrw.org | Non-profit | Germany | Jul 28, 2026 |
| Horst Weier weier.org | Manufacturing | Germany | Jul 28, 2026 |
| Zimmermann Norm zinorm.de | Manufacturing | Germany | Jul 28, 2026 |
| Gallatin Valley Surgical Arts gvsurgicalarts.com | Healthcare | United States | Jul 27, 2026 |
| Upland Unified School District k12.ca.us | Education | United States | Jul 27, 2026 |
Showing the 20 most recent of 555. Browse recent data breaches for more.
SafePay leak sites
Addresses we've seen SafePay publish victims from. Any .onion address needs the Tor Browser.
j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onionsafepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onionnz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onionwmgres25e43uwgebctgofo2qe23kf5vqevixiulubpovdglyizfugryd.onionnj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onioncrmbcdcdwoex6dzajbicgzrsuw2t76pomajwdpi2mb2babbfdgcc6xid.onionfcde4o7iquaspdbo5yetwqn3rfueet2zfy3wjosrc5dznyccwbiz6oyd.onionqkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onioniieavvi4wtiuijas3zw4w54a5n2srnccm2fcb3jcrvbb7ap5tfphw6ad.onion
SafePay questions
Is SafePay still active?
Yes. SafePay posted its most recent victim on August 4, 2026. That's 29 victims in the last 30 days.
How many victims has SafePay claimed?
SafePay has named 555 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 269 of them were posted in the last 12 months.
When did SafePay first appear?
The first victim we recorded for SafePay was posted on November 21, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does SafePay target?
Manufacturing accounts for the most victims we can classify, with 85. Construction follows at 48. We could identify a sector for 357 of 555 victims, so treat this as the shape of the targeting rather than a full census.
Has SafePay already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.