Anwo.cl listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Chile
• Announcement date: October 5, 2026

The Chilean-based HVAC distributor anwo.cl has been listed on the leak site of the safepay ransomware group. Following the publication of this listing, the threat actor group claims that the company's data has been compromised.

The claims made by safepay

On October 5, 2026, the safepay group published an announcement on their dedicated leak site, officially listing anwo.cl as a victim of their operations. In the announcement, the group specifically referenced the company's professional operations, which involve the distribution of HVAC and energy-efficiency equipment.

The group's decision to publish the listing serves as a public claim that they have successfully breached the organization's systems. While the listing confirms the group's intent to target the company, it is important to note that the group's claims regarding the breach are the primary source of this information.

Data involved in the alleged breach

Regarding the specifics of the incident, the provided information does not offer clarity on the exact nature of the breach. The listing names no specific data types that have been allegedly compromised.

The specific type and scope of the data allegedly compromised are not detailed in the provided screenshot or registration records. Consequently, there is no information available regarding the volume of files or the total size of the data involved in this incident.

About anwo.cl

Anwo is a prominent organization within the Chilean market. Founded in 1984 by Víctor Herrmann, the company has established itself as a leading Chilean distributor of HVAC (heating, ventilation, and air conditioning) equipment. The company provides a wide range of climate control solutions designed for both residential and commercial projects.

Analysis and potential implications

The involvement of the safepay group introduces significant risks due to their known operational methods. Given that the safepay group employs a double-extortion strategy, there may be a risk that the company's operational data or sensitive customer information has been exfiltrated. In a double-extortion scenario, attackers not only encrypt the victim's data but also steal it, threatening to leak the information on a public site if a ransom is not paid.

Such a situation could create negative impacts on the company's commercial operations in Chile and may lead to a loss of reputation. Furthermore, the publication of data could potentially introduce secondary risks such as identity theft or targeted phishing attacks for the company's employees and business partners.

Observations regarding the safepay group suggest a specific organizational structure. The group emerged in late 2024 and does not operate an affiliate program. This characteristic may suggest that the group manages its own operational processes and that the attacks could be directly orchestrated by the group itself, rather than through a network of independent affiliates.

General defensive considerations

While specific details regarding this incident remain limited, organizations in the distribution and climate control sectors can take various steps to mitigate such risks. Implementing robust data encryption, maintaining offline backups, and enforcing multi-factor authentication are common defensive measures used to protect against unauthorized access and data exfiltration. Additionally, monitoring for unusual network traffic and conducting regular security audits can help in identifying potential intrusions before they escalate into full-scale data breaches.