gjszlin.cz listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Czechia
• Sector: Professional Services
• Announcement date: May 26, 2025

The Safepay ransomware group has officially listed the Czech-based organization gjszlin.cz on its dedicated leak site. According to the group's announcement, the cybercriminal collective claims to have successfully exfiltrated a significant amount of data from the victim's systems.

The claimed attack and event details

According to the claims made by the Safepay group, the data breach is linked to a cyber incident that allegedly occurred on May 21, 2025. The group subsequently posted the victim's information on their leak site on May 26, 2025, to signal the completion of their initial phase of the attack.

Ransomware groups often utilize leak sites as a tool for psychological pressure. These sites serve as a public gallery where threat actors post the names of organizations they have targeted. By publishing the names of victims, these groups aim to increase the pressure on the targeted entity to fulfill ransom demands. This tactic is a cornerstone of modern cyber extortion, where the threat of public exposure is used as leverage against the victim organization.

Details regarding the stolen data

The Safepay group claims to be in possession of a data package totaling 30 GB. While the volume of the data has been specified, the group has not provided specific details regarding the exact nature or the specific types of files contained within the stolen information. The available evidence provided by the attackers, such as screenshots, only indicates the presence of a 30 GB ZIP file.

The listing names no specific data types.

Organization profile

Gjszlin.cz is an organization based in Zlín, Czech Republic. The entity provides professional services to local businesses and individuals within the region.

Analysis and potential implications

The situation involving gjszlin.cz highlights the risks associated with double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to threaten its public release. This dual approach increases the pressure on the victim, as they face both operational downtime and the potential for massive reputational damage and legal repercussions.

Given that the organization is based in the Czech Republic, this breach may lead to significant legal and administrative sanctions under the EU General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict data protection standards, and a confirmed breach of personal or professional data can trigger rigorous investigations by regulatory authorities.

Furthermore, there are significant secondary risks for the stakeholders involved. The leaked data could be misused by third parties, potentially leading to identity theft or highly targeted phishing attacks directed at the organization's employees and customers. Such attacks often use the stolen information to craft convincing messages that trick individuals into revealing even more sensitive credentials.

Regarding the Safepay group, it is worth noting that they emerged in late 2024. Unlike many other ransomware operations that utilize an affiliate program to scale their reach through various subcontractors, Safepay does not appear to operate an affiliate model. This suggests that the attacks attributed to them may be directly coordinated and executed by the core group itself.

General defensive considerations

To mitigate the risks posed by such groups, organizations in the professional services sector should prioritize robust security frameworks. This includes implementing strong access controls, maintaining regular offline backups, and conducting thorough employee training to recognize social engineering attempts. Continuous monitoring of network traffic can also help in detecting unauthorized data exfiltration before large volumes of data can be moved out of the environment.