dosjm.com listed by Safepay ransomware group

• Ransomware group: Safepay
• Country: Hong Kong SAR China
• Announcement date: May 6, 2025

Safepay claims data breach at dosjm.com

The Safepay ransomware group has listed the organization dosjm.com on its dedicated leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant amount of data from the target. This listing was officially published on the group's platform on May 6, 2025.

Ransomware groups often use leak sites to host information stolen during a breach. These sites serve as a public pressure mechanism, where threat actors post details about their victims to coerce them into paying a ransom. This tactic is a hallmark of modern cybercriminal operations, moving beyond simple encryption to focus on the threat of public exposure.

Details of the Safepay claim

The threat actor behind the Safepay group has provided specific details regarding the alleged attack. The group claims that the breach occurred on March 19, 2025. In their announcement, the attackers have made claims regarding the financial standing of the victim, asserting that the organization generates 5 million dollars in revenue.

By highlighting the revenue of the target, the group appears to be employing double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data. They then threaten to leak this data on their public platform unless a ransom is paid. This method increases the pressure on the victim, as the threat of a data leak can cause significant reputational and regulatory damage, even if the organization can restore its systems from backups.

Data involved in the incident

Regarding the specific content of the stolen information, the group has not provided any details. The available information from the leak site is limited to the scale of the theft. The listing names no specific data types or categories of information that were allegedly taken.

• Total claimed data size: 61.9 GB

The group's claims are supported by screenshots that display the total volume of the data, but these images do not offer insight into the nature of the files or the specific types of sensitive information that may have been compromised.

Implications and organizational risks

This claim of a data breach poses several potential risks to the organization. For any entity targeted by ransomware, the primary concerns involve operational continuity and reputation management. The threat of publishing stolen data can lead to a loss of trust among clients, partners, and stakeholders. Furthermore, because the organization is based in Hong Kong, the incident may trigger legal processes under relevant local data protection regulations if the claims are verified.

The Safepay group has been active since late 2024, suggesting a level of established operational capability. Organizations targeted by such groups should be prepared for secondary threats. Following an initial breach, victims often face secondary attacks or highly targeted phishing attempts designed to exploit the chaos of the incident or to gain further access to the network.

To defend against such threats, organizations typically focus on robust security postures. This includes maintaining regular, offline backups to ensure operational continuity and implementing strict access controls to limit the movement of attackers within a network. Additionally, monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are critical steps for mitigating the impact of both encryption and data theft attacks.