estrumar.es listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Manufacturing
• Announcement date: December 29, 2025

The Spanish metal manufacturing firm estrumar.es has been listed on the leak site of the safepay ransomware group. The threat actor known as safepay announced the institution on December 29, 2025, claiming to have gained access to the organization's systems and threatening to release data.

The claimed attack and threat

According to the announcement made by the safepay group, the threat actor claims to have successfully breached the systems of estrumar.es. This announcement was posted on the group's dedicated leak site on December 29, 2025, which is the same date the group claims the attack occurred. The group has used this platform to signal their involvement and to threaten the publication of information belonging to the organization.

In many ransomware incidents, threat actors utilize leak sites to exert pressure on their victims. These sites serve as a public bulletin board where groups post the names of organizations they have compromised. By listing a company, the group aims to increase the pressure on the victim to meet their demands. This tactic is often part of a broader strategy intended to damage the target's reputation or force a payment to prevent the release of sensitive information.

Details regarding the leaked data

While the post on the leak site includes general information regarding the operations of the company, the group has not provided specific details regarding the content of the allegedly leaked data. There is currently no information on the leak site regarding the nature or scope of the leaked data.

• No specific data types have been identified in the listing.

The lack of information regarding the volume or type of data involved makes it difficult to assess the immediate impact of the breach. In such scenarios, organizations often face uncertainty regarding whether the stolen information includes intellectual property, financial records, or personal identifiable information.

About estrumar.es

Metálicas Estrumar is a metal fabrication and structural engineering company based in Burgos, Spain. The organization specializes in steel structures and metalworking solutions, serving the manufacturing sector through various engineering and fabrication services.

Risk assessment and implications

This incident may pose a risk to the institution's operational continuity and could lead to a loss of commercial reputation. Because the safepay group employs a double-extortion strategy, there is a risk that sensitive data could be published or sold to third parties. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's files but also steal sensitive data, threatening to leak it if the ransom is not paid. This adds a layer of pressure beyond simple system downtime.

Furthermore, the exposure of employee or customer data could lead to identity theft or targeted phishing attacks against the affected individuals. Since the company is based in Spain, any potential data breach could trigger legal sanctions and administrative fines under the GDPR (EU General Data Protection Regulation). Compliance with these regulations is a significant concern for European companies following a data exposure.

For organizations operating in the manufacturing and engineering sectors, maintaining robust cybersecurity measures is essential to protect operational continuity. Common defensive steps for organizations facing such threats include implementing strong access controls, maintaining offline backups, and conducting regular security audits. Given that public information about the safepay group is limited, organizations must remain vigilant against the evolving tactics used by such threat actors.