gob.pe listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Peru
• Sector: Government & Defense
• Announcement date: September 15, 2026

The Peruvian government's digital platform, gob.pe, has been listed on the leak site of the ransomware group known as safepay. The group published an announcement on their leak site on September 15, 2026, claiming that the institution has been targeted in a cyberattack.

The claimed attack and group tactics

According to the announcement made by the safepay group, the organization gob.pe was targeted on September 15, 2026. The group claims to have targeted data used for the institution's digital services and administrative procedures. This listing may be interpreted as an attempt by the group to exert pressure on the institution through double extortion tactics.

Double extortion is a common strategy employed by modern ransomware groups. In this method, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat actors then threaten to leak this stolen information on public or private leak sites if the ransom is not paid. This approach significantly increases the pressure on the victim, as the threat of a data breach can cause irreparable reputational damage and legal consequences, even if the organization can restore its systems from backups.

Data involved in the incident

Regarding the specific nature of the information involved in this incident, there is no specific information regarding the nature of the leaked or threatened data in the provided record. The listing names no specific data types.

About gob.pe

gob.pe is the official digital service and information portal of the Peruvian government for its citizens. It serves as a central platform facilitating interaction between public institutions and the public.

Analysis and potential implications

This incident highlights the potential impact of cyberattacks on public institutions regarding citizen data. If data is leaked, secondary risks such as identity theft involving citizens' personal identification and administrative records may arise. The institution may face legal obligations under Peruvian data protection regulations, and a negative impact on public trust may be observed.

The safepay group is known to have emerged in late 2024 and employs double extortion tactics; this suggests that the institution may face a challenging process in maintaining data confidentiality. When public sector entities are targeted, the scale of the potential impact is often magnified due to the sensitive nature of the administrative records and personal identifiers held by the state.

For organizations operating within the government and defense sector, maintaining robust cybersecurity postures is critical. Common defensive steps for such institutions include implementing strict access controls, conducting regular security audits, and ensuring comprehensive logging and monitoring of administrative procedures. Furthermore, because ransomware groups often target digital service portals to reach their ultimate goal, securing the infrastructure that facilitates citizen interaction is a primary defensive priority. Protecting the confidentiality of citizen data remains a significant challenge for public institutions facing sophisticated threat actors who utilize extortion-based business models.