bisa.com.pe listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Peru
• Sector: Financial Services
• Announcement date: July 22, 2025

bisa.com.pe listed on safepay ransomware leak site

The ransomware group known as safepay has listed the Peruvian organization bisa.com.pe on its leak site. In an announcement made on July 22, 2025, the group claimed to have targeted the company and successfully exfiltrated a significant volume of data from their systems.

Details of the claimed attack

According to the post published by safepay on July 22, 2025, the group claims to have obtained 280 GB of data from the organization's systems. In addition to the claim regarding the data volume, the listing includes a countdown timer, a common tactic used by ransomware groups to increase pressure on their targets. The group also highlighted the organization's financial standing by mentioning an annual revenue of $36.5 million within the announcement.

Ransomware leak sites serve as a platform for threat actors to shame their victims and demand payment. When a group uses a leak site, they often employ double extortion tactics. This method involves not only encrypting a victim's files to disrupt operations but also stealing sensitive information to threaten the public release of that data. This dual pressure is designed to force the organization to comply with ransom demands to prevent the exposure of their proprietary or customer information.

Data involved in the breach

Regarding the specific nature of the information allegedly stolen, the group has provided no specific details. The listing does not mention any specific file types or categories of information that were compromised, providing only the total size of the data, which is claimed to be 280 GB.

About bisa.com.pe

BISA is a financial services and investment management company based in Peru. The firm provides a variety of professional services, including asset management, investment advisory, and various financial solutions tailored to both corporate and individual clients.

Analysis and potential implications

The claim made by safepay carries significant implications for the targeted entity. Given the double extortion tactics employed by the safepay group, it is possible that the exfiltrated data may be published publicly or used to exert pressure on the organization. For a company operating within the financial services sector, a data breach of this nature can lead to severe secondary risks, such as the exposure of sensitive customer information and the potential for identity theft.

Furthermore, the organization may face legal repercussions under Peruvian data protection regulations due to the alleged exposure of data. It is also worth noting that since the group reportedly does not operate an affiliate program, it is likely that these attacks are coordinated directly by the group itself rather than by third-party affiliates.

This incident is expected to negatively impact the organization's operational continuity and its overall reputation. In general, organizations in the financial sector often focus on defensive strategies such as implementing robust encryption, maintaining strict access controls, and conducting regular security audits to mitigate such risks. However, the direct coordination of attacks by groups like safepay presents a persistent challenge to the security posture of financial institutions globally.