SafePay
Data as of September 14, 2026.
Credential exposure before the attack
20% of SafePay victims whose domain we can identify (114 of 569) had employee credentials leak in the 12 months before SafePay named them as a victim.
We don't know whether any of these credentials were how SafePay gained initial access.
What industries SafePay targets
Sector identified for 368 of 569 victims.
| Manufacturing | 87 | |
| Construction | 49 | |
| Healthcare | 44 | |
| Education | 40 | |
| Financial Services | 26 | |
| Logistics | 26 | |
| Non-profit | 16 | |
| Legal | 13 |
Where the victims are located
Country identified for 387 of 569 victims.
| Germany | 106 | |
| United States | 100 | |
| United Kingdom | 30 | |
| Canada | 29 | |
| Italy | 19 | |
| Spain | 14 | |
| Australia | 12 | |
| Argentina | 11 |
Most recent SafePay victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Compunnel compunnel.com | Technology | United States | Sep 14, 2026 |
| Gruppo Assiprime assiprime.it | Financial Services | Italy | Sep 9, 2026 |
| Cannon Puntana cannonpuntana.com | Manufacturing | Argentina | Sep 9, 2026 |
| Century Maritime Agencies cenmar-manila.com | Not identified | Philippines | Sep 9, 2026 |
| Gayafores gayafores.es | Manufacturing | Spain | Sep 9, 2026 |
| GSN Gestión gsngestion.es | Real Estate | Spain | Sep 9, 2026 |
| HBPro hbpro.pt | Technology | Portugal | Sep 9, 2026 |
| McNish Steel mcnishsteel.com | Construction | United States | Sep 9, 2026 |
| Palmetto Eye Institute palmettoeyeinstitute.com | Healthcare | United States | Sep 9, 2026 |
| Recovery Café recoverycafe.org | Non-profit | United States | Sep 9, 2026 |
| Municipality of Reichenau an der Rax reichenau.at | Government | Austria | Sep 9, 2026 |
| Air Liquide Korea airliquide.kr | Healthcare | South Korea | Aug 26, 2026 |
| La Ge Gè Pesca lagegepesca.it | Not identified | Italy | Aug 25, 2026 |
| Formatgeria Granja Rinya granjarinya.com | Not identified | Spain | Aug 17, 2026 |
| Aoyama Zaisan Networks azn.co.jp | Financial Services | Japan | Aug 4, 2026 |
| CPU Softwarehouse cpu-ag.com | Financial Services | Germany | Aug 4, 2026 |
| Hanan Transport & Cranes hanan-hov.co.il | Logistics | Israel | Aug 4, 2026 |
| Multiaqua multiaqua.com | Manufacturing | United States | Aug 4, 2026 |
| Nask Door naskdoorinc.com | Not identified | United States | Aug 4, 2026 |
| New Point new-point.it | Not identified | Italy | Aug 4, 2026 |
Showing the 20 most recent of 569. Browse recent data breaches for more.
SafePay leak sites
Addresses we've seen SafePay publish victims from. Any .onion address needs the Tor Browser.
j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onionsafepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onionnz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onionwmgres25e43uwgebctgofo2qe23kf5vqevixiulubpovdglyizfugryd.onionnj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onioncrmbcdcdwoex6dzajbicgzrsuw2t76pomajwdpi2mb2babbfdgcc6xid.onionfcde4o7iquaspdbo5yetwqn3rfueet2zfy3wjosrc5dznyccwbiz6oyd.onionqkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onioniieavvi4wtiuijas3zw4w54a5n2srnccm2fcb3jcrvbb7ap5tfphw6ad.onion
SafePay questions
Is SafePay still active?
Yes. SafePay posted its most recent victim on September 14, 2026. That's 14 victims in the last 30 days.
How many victims has SafePay claimed?
SafePay has named 569 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 247 of them were posted in the last 12 months.
When did SafePay first appear?
The first victim we recorded for SafePay was posted on November 21, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does SafePay target?
Manufacturing accounts for the most victims we can classify, with 87. Construction follows at 49. We could identify a sector for 368 of 569 victims, so treat this as the shape of the targeting rather than a full census.
Has SafePay already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.