adifse.com.ar listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Argentina
• Sector: Government & Defense
• Announcement date: January 24, 2026

Argentine state-owned company targeted by safepay

The ransomware group known as safepay has officially listed the Argentine organization adifse.com.ar on its leak site. According to an announcement published on January 24, 2026, the group claims to have conducted a cyberattack against the organization's systems. This development follows a period of alleged unauthorized access that the group claims began around January 9, 2026.

Ransomware leak sites serve as a platform for threat actors to exert pressure on their victims. These sites are used to host announcements, screenshots, or lists of compromised organizations to increase the visibility of the attack. By publicly naming a victim, the group aims to damage the organization's reputation and coerce them into meeting ransom demands. This tactic is a core component of modern cyber extortion campaigns.

Details of the claimed attack

The announcement made by safepay includes information regarding the organization's activities in railway infrastructure management. The post serves as a public claim of a successful breach. While the group has added the organization to its list of victims, the specific technical details of the intrusion method have not been provided in the public announcement.

The group's involvement indicates a targeted approach toward the entity. In many such cases, ransomware groups employ a method known as double extortion. This strategy involves not only encrypting the victim's files to disrupt operations but also exfiltrating sensitive data before the encryption occurs. The threat actors then threaten to release this stolen data on their leak site if the ransom is not paid, thereby creating a secondary layer of pressure through the threat of public exposure.

Information regarding exfiltrated data

Regarding the specific content of the alleged breach, the post does not provide details regarding the nature of the allegedly exfiltrated data. The information provided in the group's announcement is limited to general descriptive information about the organization's field of activity. The listing names no specific data types.

About ADIFSE

ADIFSE (Administración de Infraestructuras Ferroviarias Sociedad del Estado) is a state-owned company located in Argentina. The organization is responsible for the management and development of the country's railway infrastructure. Its primary mission involves working on the modernization and maintenance of the national railway network, making it a critical entity within the country's transportation and infrastructure sector.

Potential risks and security implications

This situation may pose risks to the organization's operational continuity and the security of critical infrastructure data. The use of double extortion by the safepay group increases the possibility that the organization's sensitive data could be publicly exposed. Such exposure can lead to various secondary risks, including the potential for the leaked data to be utilized for secondary attacks or targeted phishing campaigns against the organization or its stakeholders.

Furthermore, the organization may face legal obligations under data protection regulations in Argentina following such an incident. When critical infrastructure entities are targeted, the impact can extend beyond immediate data loss to broader concerns regarding national infrastructure security. Organizations in this sector typically focus on robust monitoring, network segmentation, and strict access controls to mitigate these types of risks. However, public information regarding the specific capabilities and methods of the safepay group remains limited.