iicil.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Healthcare
• Announcement date: May 30, 2025

Safepay claims to have stolen data from iicil.com

The threat actor group known as Safepay has published an announcement on its leak site claiming to possess a significant amount of data belonging to iicil.com. According to the group's post, the data exfiltration occurred around May 9, 2025, with the formal announcement appearing on the leak site on May 30, 2025. This development highlights the ongoing risks faced by specialized service providers in the medical logistics and informatics space.

The group's announcement follows a pattern of targeting organizations to exert pressure through the threat of data exposure. This method is a hallmark of modern ransomware operations, where the focus has shifted from merely encrypting local files to stealing sensitive information to ensure the victim feels compelled to meet demands.

Details of the alleged attack and claims

In their announcement, Safepay has made several specific claims regarding the breach. The group asserts that they have successfully exfiltrated 20 GB of data from the organization. Furthermore, the threat actors have publicly noted the organization's annual revenue, stating it stands at 5 million dollars. By highlighting the financial status of the target, the group may be attempting to increase pressure on the organization through double extortion tactics.

Double extortion is a common strategy used by ransomware groups where, after encrypting a victim's systems, the attackers also threaten to release sensitive data on a public leak site. This tactic is designed to maximize leverage, as even if a company can restore its systems from backups, they still face the threat of reputational damage and regulatory penalties if their private information is made public.

Data involved in the incident

Regarding the specific contents of the stolen information, the group has not provided any details. The listing names no specific data types or categories of information that were allegedly compromised, mentioning only the total size of the data package.

• 20 GB of data

About iicil.com

IICIL, which stands for the International Institute of Clinical Informatics and Logistics, is an organization that provides essential services within the healthcare sector. Based in Houston, Texas, United States, the company specializes in clinical informatics and logistics. Their operational scope includes providing data management and various operational solutions tailored for the healthcare industry.

Implications and industry considerations

This alleged data leak may pose a significant risk to the confidentiality of sensitive information within the healthcare sector. Because the organization is based in the United States, an incident of this nature could trigger investigations under HIPAA regulations regarding data privacy breaches. Healthcare organizations are subject to strict legal frameworks to ensure the protection of patient and operational data, and any breach can lead to extensive regulatory scrutiny.

The use of double extortion methods can impact an organization's operational continuity and may lead to the leaked data being used for identity theft or targeted phishing campaigns. When sensitive data is leaked, attackers often use it to craft highly convincing social engineering attacks against employees or clients, further complicating the recovery process.

Safepay has been active since late 2024. Unlike many other ransomware groups that utilize an affiliate program to scale their operations, it can be inferred that Safepay manages its operations directly. This direct management style often indicates a centralized command structure within the threat group.

For organizations operating in the healthcare and logistics sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing strict access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.