Gravelec.ch listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: May 11, 2025

Safepay claims data breach against Gravelec.ch

The ransomware group known as Safepay has officially listed the Swiss organization Gravelec.ch on its dedicated leak site. According to the group's announcement, they claim to be in possession of a significant amount of data belonging to the company. This development follows a period of activity from the group, which first emerged in late 2024.

The listing occurred on May 11, 2025, although the group alleges that the actual attack took place much earlier, on April 14, 2025. This discrepancy between the date of the breach and the date of public disclosure is a common occurrence in ransomware operations, where threat actors may hold data for several weeks or months to increase pressure on the target during negotiations.

Details of the alleged incident

In their announcement, the Safepay group provided several specific claims regarding the target and the scale of the operation. The group asserts that the organization in question generates 5.8 million dollars in revenue. This information is often used by ransomware groups to establish the potential value of a victim and to justify their ransom demands during extortion attempts.

Regarding the stolen information, the group claims to have acquired a 6.9 GB archive file. However, the group has not provided any specific details regarding the nature or the contents of the alleged leaked data. The listing does not specify the types of files contained within the archive, leaving the exact scope of the sensitive information compromised unknown at this time.

About Gravelec.ch

Gravelec SA is a manufacturing company based in Switzerland. The organization specializes in the production of electrical equipment, wiring, and various industrial assembly solutions. Given its role in the manufacturing sector, the company serves as a component of industrial supply chains.

Impact and risks of the alleged breach

The alleged data breach by the Safepay group carries several significant risks for the organization. Primarily, such an incident can negatively impact the organization's operational continuity and its commercial reputation. When a manufacturing firm's data is compromised, it can disrupt production schedules and erode the trust of business partners and clients.

Because the organization is based in Switzerland, the presence of personal data within the leaked files could trigger legal processes under the Federal Act on Data Protection (FADP). Compliance with such regulations is critical for Swiss entities to avoid legal repercussions and heavy fines.

Furthermore, the Safepay group appears to utilize double extortion tactics. In these scenarios, attackers do not just encrypt a company's systems but also threaten to publish sensitive data on public leak sites to force payment. This tactic significantly increases the risk of the organization being subjected to secondary attacks, such as targeted phishing campaigns, where attackers use the stolen information to trick employees or partners.

Additionally, the activities of this group pose an indirect risk to the organization's supply chain partners. In modern industrial environments, a breach in one company can potentially expose vulnerabilities or sensitive information related to the broader network of suppliers and customers. Organizations in the manufacturing sector can mitigate these risks by implementing robust data protection measures, maintaining strict access controls, and ensuring regular backups are stored offline to protect against encryption-based attacks.