kres.cz listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Czechia
• Sector: Retail & E-Commerce
• Announcement date: February 7, 2026

The Czech-based retail and e-commerce firm kres.cz has been listed on the leak site of the safepay ransomware group. According to the announcement made by the threat actors, the organization has been targeted in a data breach incident.

The claims made by safepay

The threat actor known as safepay listed the entity kres.cz on its leak platform on February 7, 2026. In the announcement, the group claims to have obtained the company's data and has initiated a countdown timer as part of its pressure tactics. This specific threat group is known to have emerged in late 2024 and is recognized for employing a double extortion strategy during its operations.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not just encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid. This approach increases the pressure on the victim, as the threat of data exposure can cause significant reputational and regulatory damage even if the company can restore its systems from backups.

Details regarding the alleged data breach

Despite the listing on the leak site, the group has not provided specific details or sample files regarding the nature of the allegedly exfiltrated data. No information has been released concerning the volume of data or the specific types of files that may have been compromised during the incident.

Organization profile

kres.cz is a Czech SME headquartered in the city of Krnov. The company specializes in the sale, repair, and technical service of various products.

Analysis and potential implications

The publication of the company's data may lead to the exposure of employee and customer information. As a company based in the Czech Republic, a potential data breach could trigger legal obligations under the GDPR (EU General Data Protection Regulation). Organizations operating within the European Union must adhere to strict protocols regarding the protection of personal data and the timely reporting of breaches to relevant authorities.

The double extortion method used by the safepay group may threaten the company's operational continuity and could lead to secondary risks such as identity theft or targeted phishing attacks. When sensitive data is leaked, attackers often use the stolen information to conduct highly convincing social engineering campaigns against the victims or their associates.

Furthermore, the company's supply chain partners may also be indirectly affected by this situation. In a modern digital economy, a breach in one organization can create ripple effects throughout a network of vendors and partners. To mitigate such risks, organizations in the retail and e-commerce sectors often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust data encryption protocols to protect sensitive customer and corporate information.