Lampus.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Manufacturing
• Announcement date: December 14, 2025

The Safepay ransomware group has listed lampus.com on its dedicated leak site, alleging that the organization has suffered a significant data breach. This announcement, posted on December 14, 2025, marks a new development in the group's ongoing activities against various targets.

Details of the alleged attack

According to the claims made by the threat actor known as Safepay, the group successfully gained unauthorized access to the systems of lampus.com. The group asserts that they have exfiltrated data from the organization's network. The timing of the announcement suggests that the breach may have occurred much earlier, with the group claiming the attack took place on October 30, 2025.

The announcement is presented as a direct threat targeting the manufacturing operations of the company. Ransomware leak sites are frequently used by cybercriminals to exert pressure on victims. By publicly listing a company, these groups aim to damage the victim's reputation and create urgency, often as a tactic to coerce the organization into paying a ransom to prevent the release of sensitive information.

Data involved in the claim

While the threat actor has confirmed the occurrence of a data breach, they have not provided specific details regarding the nature of the allegedly exfiltrated data. No specific information has been shared concerning the types of files, the volume of information, or the specific contents that were taken from the organization's systems.

• No specific data types were named in the listing.

The organization profile

R.I. Lampus Company is a long-established American manufacturer and distributor of building materials. Based in Pennsylvania, the company provides various concrete products for the construction industry, such as concrete blocks, retaining walls, and landscaping products. As a significant player in the manufacturing and distribution of construction materials, the company maintains essential operations within the United States.

Analysis and implications

The use of double extortion tactics by the Safepay group suggests that the organization's sensitive data may be at risk of public disclosure. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's data but also steal it, threatening to leak it on a public forum if the ransom is not met. This approach significantly increases the pressure on an organization, as the threat moves from mere operational disruption to a potential long-term reputational and legal crisis.

As a US-based manufacturing firm, a potential data breach could lead to legal consequences under state-level data protection laws and industry-specific regulations. The exposure of employee or customer data could create a foundation for identity theft and targeted phishing attacks. Furthermore, the pressure exerted on the organization's operational continuity may be considered a tactic to coerce ransom payments.

The emergence of the Safepay group in late 2024 indicates that their activities may still be in an evolving phase. For organizations in the manufacturing sector, such threats highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing strong access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by evolving threat actors.