Accademia.it listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Italy
• Sector: Education
• Announcement date: July 16, 2025

Safepay claims data breach at Accademia.it

The Safepay ransomware group has officially listed the Italian organization Accademia.it on its leak site. According to the announcement made on July 16, 2025, the threat actor group claims to have successfully carried out a ransomware attack against the institution, resulting in a significant data leak.

The group's announcement indicates that the initial compromise likely occurred several months prior to the public listing. Specifically, the group claims that the attack took place on May 27, 2025. This timeline suggests that the attackers may have had prolonged access to the network before moving to the extortion phase of their operation.

Details of the claimed attack

While the specific nature of the breach remains under investigation, the Safepay group has provided certain metrics regarding the target and the scope of the theft. The group claims that the organization in question has an annual revenue of 5 million dollars. This information is often used by ransomware groups to establish the perceived value of a target during extortion negotiations.

Regarding the stolen information, the group has released a specific volume of data. The following details have been provided by the threat actor:

• Total claimed data size: 40.8 GB

There is no detailed information regarding the specific content of the leaked data. The available evidence, such as screenshots provided by the group, only indicates the total size of the data volume, without specifying the types of files or the nature of the information contained within the 40.8 GB archive.

About Accademia.it

Accademia Italiana is a private higher education institution located in Italy. The institution specializes in providing various academic programs, including fashion, design, photography, and visual arts. The organization maintains a physical presence across the country, with campuses situated in both Rome and Florence.

Impact assessment and security implications

The publication of this data by the Safepay group carries several significant risks for the organization. This incident may negatively impact the operational continuity of the institution and cause lasting damage to its reputation. Because the organization is based in Italy, the leak of potentially sensitive information could trigger legal sanctions under the General Data Protection Regulation (GDPR) if personal data is confirmed to be part of the breach.

The Safepay group is known to employ a double-extortion strategy. In such attacks, the threat actors do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. If the victim refuses to pay the ransom, the attackers threaten to publish the stolen information on public leak sites. This method creates secondary risks for the victims, such as identity theft and the potential for highly targeted phishing attacks against the organization's students, staff, or partners.

Furthermore, this breach poses a security risk to other stakeholders within the organization's supply chain. When an educational institution is compromised, the interconnected nature of modern academic networks means that third-party vendors and partners may also face increased exposure. Public information regarding the specific tactics, techniques, and procedures of the Safepay group remains limited, making it difficult for defenders to proactively defend against this specific actor.

For organizations in the education sector, maintaining robust security postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for staff and students to prevent initial access via phishing.