Interr.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Technology
• Announcement date: January 24, 2026

Safepay claims data breach at Interr.com

The Safepay ransomware group has listed the security and risk management company Interr.com on its dedicated leak site. This announcement, made on January 24, 2026, marks a new development in the group's activities. The group alleges that they have successfully carried out an attack against the organization and claims to have obtained the company's data.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. These sites are used to announce successful breaches and to shame organizations into paying ransoms. When a group lists a victim on such a site, it often signals the beginning of a public extortion attempt, where the threat of releasing sensitive information is used as leverage to demand payment.

Details of the alleged incident

According to the announcement published by the Safepay group, the claim of a data breach was made on January 24, 2026. The group's post regarding Interr.com includes text that describes the company's various operations and the professional services it provides to its clients. This type of descriptive content is frequently used by threat actors to confirm they have targeted a specific entity and to demonstrate their awareness of the victim's business model.

Regarding the specific information that has been targeted, there is no information available regarding the nature of the data allegedly leaked. The listing does not specify the types of files, the volume of information, or the specific databases that may have been accessed during the claimed attack.

Affected data types

The listing names no specific data types.

About Interr.com

Interr is a London-based private security and risk management services company. The organization provides professional security solutions and consultancy services across various sectors. Given its role in providing security and risk management, the company operates in a sector where the integrity and confidentiality of information are of paramount importance.

Analysis and potential implications

The use of double extortion by the Safepay group suggests that the company's data may be at risk of being published. Double extortion is a tactic where attackers not only encrypt an organization's systems but also steal sensitive data, threatening to leak it on a public forum if the ransom is not paid. This method significantly increases the pressure on the victim, as the threat shifts from simple operational disruption to permanent reputational and legal damage.

Because the entity is based in the United Kingdom, a potential data breach could lead to legal sanctions and administrative fines under the UK GDPR. Data protection regulations in the UK impose strict requirements on how organizations handle personal information, and failures in security can result in significant regulatory scrutiny. Furthermore, since the company operates in the security and risk management sector, the sensitivity of the leaked data may be high, potentially creating secondary risks for its clients. A breach of this nature could lead to reputational damage and raise concerns regarding the company's supply chain security, as clients rely on such firms to protect their own interests.

The Safepay group emerged in late 2024, and the fact that they are targeting specialized security firms warrants close monitoring of their activities. Organizations in the security and risk management sector can take several defensive steps to mitigate such risks, including implementing robust encryption for data at rest and in transit, maintaining strict access controls, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.