Bio-strath.com listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Switzerland
• Sector: Healthcare
• Announcement date: September 28, 2026

The ransomware group known as safepay has listed the Swiss-based healthcare product manufacturer bio-strath.com on its leak site. This announcement, made on September 28, 2026, follows the group's claim of a ransomware incident involving the organization.

The claimed ransomware incident

On September 28, 2026, the safepay group officially listed bio-strath.com on its leak site, claiming that a ransomware incident has taken place. In conjunction with this listing, the group shared specific details regarding the operations of the company and initiated a countdown timer on their platform. This sequence of actions reflects an allegation that an unauthorized intervention has been performed on the company's systems.

Ransomware leak sites serve as a public stage for cybercriminals to exert pressure on their victims. By listing an organization and starting a countdown, these groups attempt to create a sense of urgency, often aiming to force the victim into paying a ransom to prevent the release of sensitive information. Such tactics are a hallmark of modern cyber extortion campaigns.

Details regarding the data involved

At this stage, the specific nature or type of the data allegedly exfiltrated has not been disclosed by the group. The listing does not provide information regarding the volume of files or the total size of the data involved, nor has a ransom demand been specified in the current announcement.

The listing names no specific data types at this time.

About bio-strath.com

Bio-Strath is a Swiss healthcare company that was founded in 1961. The organization is best known for its herbal yeast-based nutritional supplements. The company's product line includes the production of natural dietary supplements in both liquid and tablet forms.

Analysis and potential impact

Given that the safepay group employs a double-extortion strategy, there may be a risk that the company's sensitive data could be published. Double extortion is a method where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay.

As a Swiss-based entity, a potential data breach could trigger compliance processes under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). The implications of such a breach extend beyond legal compliance, as employees and customers of the organization may be at risk of identity theft or targeted phishing attacks resulting from the exposure of personal information.

The fact that the safepay group emerged in late 2024 suggests that its operational methods may not yet be fully analyzed by the security community. Furthermore, such an announcement may create an indirect impact on the company's supply chain partners, as interconnected business relationships can be vulnerable to the fallout of a primary target's compromise.

Organizations operating in the healthcare sector often face heightened risks due to the sensitive nature of the data they process. Defensive measures typically involve robust encryption, strict access controls, and continuous monitoring to detect unauthorized interventions. Maintaining a strong security posture is essential to mitigate the risks of both operational disruption and the subsequent reputational and legal consequences of a data leak.