duhaas.sk listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Slovakia
• Announcement date: October 5, 2026

Slovakian firm duhaas.sk targeted by safepay ransomware group

The safepay ransomware group has announced the Slovakian company duhaas.sk on its dedicated leak platform. According to the announcement made on October 5, 2026, the group claims to have carried out a targeted action against the digital assets of the organization. This listing serves as a public notification from the threat actor, marking the company as a victim of their operations.

Details of the claimed attack

The listing provided by the safepay group includes general information regarding the operations of duhaas.sk, but it lacks specific technical details. While the group asserts that they have successfully targeted the company's digital infrastructure, the announcement does not provide specific information regarding the nature of the data leak or any ransom demands. At this stage, the group has not disclosed the specific methods used to access the company's systems or the exact timing of the initial intrusion beyond the date of the announcement.

Data involved in the incident

Regarding the content of the alleged breach, the announcement does not contain any specific information regarding the type or content of the data allegedly leaked. The listing names no specific data types.

About duhaas.sk

DUHA a.s. is a construction and engineering company based in Slovakia. The firm specializes in critical infrastructure projects, including road construction and bridge building. Given its role in large-scale engineering and infrastructure, the company's operations are central to regional development and structural maintenance.

Analysis and industry implications

The safepay group is known to operate using a double-extortion model. In such a model, threat actors do not merely encrypt a victim's data to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. This allows the attackers to threaten the public release of stolen data if the ransom is not paid, creating a secondary layer of pressure on the organization. This suggests that sensitive data belonging to the company may have been exfiltrated or could be published in the future.

Because the company is based in Slovakia, any potential data breaches may fall under the scope of the EU General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on how personal data is handled and requires organizations to report significant breaches to authorities. Furthermore, given the company's sector, the exposure of engineering projects and infrastructure data could potentially impact commercial interests and sensitive project details.

The operational style of the safepay group is also notable, as they are reported to operate without an affiliate program. This characteristic may indicate that attacks are coordinated directly by the group itself, rather than through a decentralized network of independent actors. This direct coordination can sometimes lead to more focused targeting.

For organizations operating in the construction and engineering sectors, such incidents highlight the importance of robust cybersecurity frameworks. Protecting sensitive engineering designs, infrastructure data, and commercial contracts is vital to maintaining competitive advantages and public trust. Defensive strategies typically involve implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to detect unauthorized access to digital assets before data exfiltration can occur.