Ettp.be listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Belgium
• Sector: Professional Services
• Announcement date: May 6, 2026

Safepay claims ettp.be in a new leak site listing

The safepay ransomware group has announced that it has listed the Belgian organization ettp.be on its dedicated leak site. This announcement, made on May 6, 2026, marks the latest activity from the threat actor group involving a professional services entity.

Ransomware leak sites serve as a platform for cybercriminals to pressure victims by threatening to publish stolen information. When a group lists an organization, it typically signifies that the attackers claim to have successfully breached the target's network and exfiltrated sensitive data. This tactic is a central component of modern cyber extortion campaigns designed to maximize leverage over the victim.

Details of the claimed attack

According to the announcement made by the safepay group, the entity targeted is ettp.be. The group claims that the organization operates within the professional services sector, specifically involving fields such as professional training, technology consulting, and industrial services. This sector is often targeted by threat actors due to the sensitive nature of the data handled during consulting and training engagements.

Regarding the specifics of the breach, the group has not provided any information regarding a ransom demand. Furthermore, the announcement did not include details concerning the volume of leaked data or the specific number of files involved in the incident. At this time, no information or sample files regarding the nature of the leaked data have been shared by the group.

The organization profile

The targeted entity, ETTP (European Training and Technology Platform), is a Belgium-based organization. It is active in the fields of professional training, technology consulting, and industrial services. The platform is responsible for managing various projects and professional development programs across Europe, making it a significant player in its operational region.

Risk assessment and industry implications

Because the safepay group is known to employ a double-extortion strategy, there is a potential risk that the organization's sensitive data could be published. Double extortion involves two stages: first, encrypting the victim's data to disrupt operations, and second, threatening to leak the stolen data to damage the organization's reputation or force payment. This method increases the pressure on companies to comply with ransom demands.

The listing names no specific data types involved in the breach. However, the potential impact of such an event can be significant. Since the entity is based in Belgium, a potential data breach may lead to legal consequences under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must carefully evaluate their data breach notification obligations to remain compliant with these strict regulatory frameworks.

Furthermore, because the organization's professional training and consulting activities may involve customer and employee information as well as intellectual property, this could create secondary risks. The loss of intellectual property or sensitive client information can lead to long-term competitive disadvantages and loss of trust.

The safepay group, which emerged in late 2024, currently has limited public information available regarding its specific tactics, techniques, and procedures. For organizations in the professional services and technology consulting sectors, this incident highlights the necessity of reviewing security measures and maintaining robust incident response plans. Proactive defense and continuous monitoring are essential to mitigate the risks posed by emerging ransomware groups.