iql-nog.com listed by Safepay ransomware group

• Ransomware group: Safepay
• Country: Spain
• Announcement date: June 2, 2026

Safepay ransomware group claims attack on iql-nog.com

The Safepay ransomware group has listed the Spain-based chemical manufacturer iql-nog.com on its dedicated leak site. According to the announcement made by the group, the organization has been the target of a ransomware incident, marking a significant potential security breach for the industrial firm.

Details of the alleged incident

The announcement regarding iql-nog.com was posted on the Safepay leak site on June 2, 2026. Through this listing, the threat actor group alleges that the organization was compromised on May 21, 2026. This timeline suggests that the attackers may have maintained presence within the network for a period of time prior to the public announcement.

The group asserts that they have successfully obtained data related to the organization's operations and its specific chemical production processes. While the group has made these claims, the specific nature and exact contents of the leaked data have not been specified in the announcement.

Data involved in the claim

The listing names no specific data types or file categories that were allegedly exfiltrated during the incident.

About iql-nog.com

Founded in 1947, iql-nog.com is a company that specializes in the production of oleochemical products. The firm focuses particularly on fatty acid esters and specialty chemicals. Based in Spain, the company provides various chemical solutions intended for a range of industrial applications.

Analysis and potential risks

This claim may indicate a significant risk of exposure for the organization's operational data and intellectual property. Because the entity is based in Spain, a potential data breach of this nature could lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR).

The Safepay group is known for employing double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems but also exfiltrate sensitive information to use as leverage. This method allows threat actors to threaten the victim with the public release of stolen data to compel ransom payments. Consequently, it is possible that the exfiltrated data could be used in secondary attacks or corporate blackmail schemes.

Furthermore, secondary risks may emerge from this incident. These include the possibility of targeted phishing attacks directed at supply chain partners and customers of the organization. When industrial data or client information is compromised, attackers often use it to craft highly convincing social engineering campaigns to expand their reach within the industry ecosystem.

General defensive considerations

In the face of such threats, organizations typically focus on several defensive pillars. Implementing robust network segmentation can help contain an attacker's movement within a network. Regular, offline, and tested backups remain a fundamental defense against the encryption aspect of ransomware. Additionally, monitoring for unauthorized data exfiltration and maintaining strict access controls are critical steps in mitigating the impact of double extortion tactics.