lfgholding.com listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Switzerland
• Announcement date: September 28, 2026

The Switzerland-based financial services group lfgholding.com has been listed on a leak site by the ransomware group known as safepay. The announcement, which appeared on September 28, 2026, marks a potential security incident involving the institution.

Details of the claim

The threat actor identified as safepay published an announcement on its leak site on September 28, 2026, claiming that lfgholding.com has been targeted. In the announcement, the group provided details regarding the institution's operations and its overall business model. This specific type of listing is used by ransomware groups to pressure organizations by highlighting their presence and operational scale within their respective sectors, in this case, the financial services industry.

Ransomware leak sites serve as a public platform where cybercriminals post information about their victims. These sites are often used as part of a negotiation tactic to increase pressure on the targeted entity. By publishing information about a company's business model, the attackers aim to demonstrate their access and visibility into the organization's internal structure.

Data involved in the incident

Regarding the specifics of the alleged breach, the announcement provided no information concerning the type or the scope of the data that has supposedly been leaked. The information shared by the group consisted of a screenshot containing general text that describes the institution's areas of operation rather than specific sensitive files. Consequently, the listing names no specific data types.

In many modern cyberattacks, threat actors employ a strategy known as double extortion. In this scenario, attackers do not only encrypt an organization's data to disrupt operations but also steal sensitive information before the encryption occurs. The threat of releasing this stolen data on a public leak site provides the attackers with additional leverage during ransom negotiations, as the victim faces the risk of public exposure and regulatory scrutiny.

About lfgholding.com

LFG Holding is an independent, partner-owned wealth management group based in Switzerland. The company manages a diverse portfolio that consists of various specialized financial services businesses, operating within the highly regulated financial sector.

Risk assessment and industry implications

The listing of a financial institution by a group like safepay carries significant implications. Because the safepay group utilizes a double-extortion strategy, there is a potential risk that sensitive client or financial data may have been compromised. For a Swiss-based entity, a confirmed data breach could trigger mandatory legal obligations under the Swiss Federal Act on Data Protection (FADP) as well as the General Data Protection Regulation (GDPR).

Furthermore, for organizations operating within the financial sector, the leakage of even limited information can lead to secondary risks. These include the potential for stolen data to be utilized in identity theft or for highly targeted phishing attacks against clients. The group's emergence in late 2024 suggests that their operational methods and tactics may continue to evolve over time.

Beyond the immediate technical and legal concerns, the institution could face significant secondary risks, such as reputational damage and a loss of client trust. Organizations in the financial sector typically mitigate these risks by implementing robust security frameworks, maintaining strict access controls, and ensuring comprehensive monitoring of their networks to detect unauthorized movements early.