File · safepay · Crime · ransomware.live · refreshed 2026-10-06 · on the wire

safepay

sigil · no ATT&CK coverage stated

Last 30 days

last seen 7 d ago

dispatches48

victims24

CVEs seen0

seen against: Germany · Switzerland · Belgium · Czechia · Chile
sectors: Other · Technology · Not Found · Retail & E-Commerce · Manufacturing

What changed

ledger · newest first

—17 d agovictimsvictim count 60 → 69 (+9)
—24 d agovictimsvictim count 51 → 60 (+9)
—1 mo agovictimsvictim count 40 → 51 (+11)

Analyst brief

ransomware.live

SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.

Observed targets (as stated by the sources)

22 countries · 10 sectors

assessed originnot stated by sourcesobserved targets · 22

countries · 22

United States
Germany
Switzerland
Italy
Spain
Czechia
Belgium
Mexico
Philippines
Japan
Chile
Slovakia
Malaysia
Netherlands
Lithuania
Peru
Austria
Argentina
Portugal
Canada
South Korea
Israel

sectors · 10

Manufacturing
Technology
Professional Services
Other
Retail & E-Commerce
Not Found
Healthcare
Agriculture and Food Production
Hospitality
Government & Defense

as stated by MISP galaxy / ransomware.live — not inferred

Victims

leak-site listings via ransomware.live

Leak-site victim figures
Victims observed	First observed	Last observed on leak site	Lifetime rate	Last 30 days
53	2026-06-01	2026-10-05	≈ 13.3 / month	above the lifetime rate 24

Victims observed: 53
First observed: 2026-06-01
Last observed on leak site: 2026-10-05
Lifetime rate: ≈ 13.3 / month
Last 30 days: above the lifetime rate 24

lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew

On the wire

1 dispatch · newest first

2026-10-05Ransomware: safepay → t-systems.com

Take it with you

keyless · no signup

References

1 source

1.ransomware.live

Track safepay on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.