acsmallmaxwell.com.au listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Australia
• Sector: Professional Services
• Announcement date: July 20, 2026

The Safepay ransomware group has officially listed the Australian-based accounting and advisory firm acsmallmaxwell.com.au on its dedicated leak site. This announcement, made on July 20, 2026, marks a significant development in the ongoing threat landscape facing professional service providers in the region.

The claims made by Safepay

According to the announcement posted on the group's platform, the Safepay group claims to have successfully obtained data belonging to acsmallmaxwell.com.au. Following the initial listing, the group has reportedly initiated a countdown, a common tactic used by ransomware operators to pressure victims into meeting specific demands.

The group's announcement included various details regarding the firm's operational history and its professional background. While the group has claimed to have access to the institution's data, the specific nature and volume of the allegedly compromised information have not been disclosed by the attackers at this time.

Details regarding the alleged data breach

At this stage of the incident, no specific information regarding the nature of the allegedly leaked data has been provided by the Safepay group. The announcement text does not specify the types of files, the total volume of data, or the specific contents that have been targeted during the attack.

The listing names no specific data types involved in the breach.

Organization profile

AC Small & Maxwell is an Australian-based accounting and financial advisory firm that was established in 1916. The firm provides a wide range of professional financial services to both businesses and individuals, covering essential areas such as accounting, taxation, auditing, and payroll administration.

Analysis and industry implications

Given the known tactics of the Safepay group, which include the use of double-extortion methods, there is a possibility that financial and personal data belonging to the firm's clients may have been compromised. Double-extortion is a technique where attackers not only encrypt an organization's data but also steal sensitive information, threatening to leak it publicly if a ransom is not paid. This approach increases the pressure on victims by threatening their reputation and regulatory standing.

As an accounting firm operating within Australia, any potential data breach could lead to significant legal consequences under the Australian Privacy Act 1988. The sensitivity of the information handled by professional services firms makes them high-value targets for cybercriminals seeking to exploit client data for secondary purposes.

The secondary risks arising from such a breach may include identity theft and the launch of targeted phishing attacks directed at the firm's clients and employees. These follow-on attacks often leverage the stolen information to gain further access or to defraud individuals through highly convincing social engineering schemes.

Regarding the threat actor, Safepay is a group that emerged in late 2024. Notably, the group does not appear to operate an affiliate program, which may indicate that their attacks are coordinated directly by the group itself rather than through a distributed network of independent actors.

For organizations operating in the professional services sector, maintaining robust security postures is critical. This typically involves implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Furthermore, ensuring compliance with regional privacy laws and maintaining comprehensive incident response plans are vital steps in mitigating the impact of potential cyber incidents.