SafePay
Data as of October 1, 2026.
Credential exposure before the attack
19.5% of SafePay victims whose domain we can identify (115 of 590) had employee credentials leak in the 12 months before SafePay named them as a victim.
We don't know whether any of these credentials were how SafePay gained initial access.
What industries SafePay targets
Sector identified for 384 of 590 victims.
| Manufacturing | 93 | |
| Construction | 51 | |
| Healthcare | 47 | |
| Education | 40 | |
| Financial Services | 27 | |
| Logistics | 26 | |
| Non-profit | 16 | |
| Government | 15 |
Where the victims are located
Country identified for 407 of 590 victims.
| Germany | 110 | |
| United States | 102 | |
| United Kingdom | 30 | |
| Canada | 29 | |
| Italy | 19 | |
| Spain | 15 | |
| Australia | 12 | |
| Japan | 12 |
Most recent SafePay victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Assist2Enjoy assist2enjoy.be | Not identified | Belgium | Oct 1, 2026 |
| Econ-Tec econ-tec.com | Manufacturing | Germany | Oct 1, 2026 |
| Wolf & Sofsky wolfusofsky.de | Construction | Germany | Oct 1, 2026 |
| Auromex auromex.com | Manufacturing | Thailand | Sep 29, 2026 |
| Bio-Strath bio-strath.com | Not identified | Switzerland | Sep 29, 2026 |
| Cromados Modernos cromados.com | Manufacturing | Spain | Sep 29, 2026 |
| Euregio Adviesgroep eagroep.com | Not identified | Netherlands | Sep 29, 2026 |
| Fe Del Mundo Medical Center fedelmundo.com.ph | Healthcare | Philippines | Sep 29, 2026 |
| IHG ihg.com | Not identified | Not identified | Sep 29, 2026 |
| LFG lfgholding.com | Financial Services | Switzerland | Sep 29, 2026 |
| Municipality of Manno manno.ch | Government | Switzerland | Sep 29, 2026 |
| City of Šumperk sumperk.cz | Government | Czech Republic | Sep 29, 2026 |
| ARA Lyss ara-lyss.ch | Energy | Switzerland | Sep 16, 2026 |
| Government of Peru gob.pe | Government | Peru | Sep 16, 2026 |
| Centro Hospitalario La Concepción laconcepcion.com.mx | Healthcare | Mexico | Sep 16, 2026 |
| Marlin Mechanical marlinhvac.com | Construction | United States | Sep 16, 2026 |
| Karl Kuntze meterex.com | Manufacturing | Germany | Sep 16, 2026 |
| Neumerkel neumerkel-gmbh.de | Manufacturing | Germany | Sep 16, 2026 |
| Ryomo Systems ryomo.co.jp | Technology | Japan | Sep 16, 2026 |
| Stöcklin Möbel stoecklin-kuechen.ch | Manufacturing | Switzerland | Sep 16, 2026 |
Showing the 20 most recent of 590. Browse recent data breaches for more.
SafePay leak sites
Addresses we've seen SafePay publish victims from. Any .onion address needs the Tor Browser.
j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onionsafepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onionnz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onionwmgres25e43uwgebctgofo2qe23kf5vqevixiulubpovdglyizfugryd.onionnj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onioncrmbcdcdwoex6dzajbicgzrsuw2t76pomajwdpi2mb2babbfdgcc6xid.onionfcde4o7iquaspdbo5yetwqn3rfueet2zfy3wjosrc5dznyccwbiz6oyd.onionqkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onioniieavvi4wtiuijas3zw4w54a5n2srnccm2fcb3jcrvbb7ap5tfphw6ad.onion
SafePay questions
Is SafePay still active?
Yes. SafePay posted its most recent victim on October 1, 2026. That's 32 victims in the last 30 days.
How many victims has SafePay claimed?
SafePay has named 590 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 257 of them were posted in the last 12 months.
When did SafePay first appear?
The first victim we recorded for SafePay was posted on November 21, 2024. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does SafePay target?
Manufacturing accounts for the most victims we can classify, with 93. Construction follows at 51. We could identify a sector for 384 of 590 victims, so treat this as the shape of the targeting rather than a full census.
Has SafePay already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.