mactavishco.ca listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Canada
• Sector: Retail & E-Commerce
• Announcement date: December 5, 2025

The ransomware group known as Safepay has officially listed the Canadian retail company mactavishco.ca on its dedicated leak site. This announcement, made on December 5, 2025, marks a new development in the group's activities, claiming that the organization has been targeted in a cyberattack.

The claims made by Safepay

According to the announcement published by the threat actor, the breach is linked to an attack that allegedly took place on November 19, 2025. The Safepay group, which has been active since its emergence in late 2024, is described as an entity that operates using the double-extortion method. This specific tactic involves both encrypting a victim's data to disrupt operations and threatening to leak sensitive information to the public to increase pressure on the target.

It is important to note that Safepay does not appear to utilize an affiliate program, suggesting a more centralized operational structure. Because the group has only recently emerged in the threat landscape, their specific methodologies and long-term patterns may not yet be fully analyzed by the broader cybersecurity community, introducing a level of uncertainty regarding their exact operational procedures.

Details regarding the alleged data leak

Despite the public listing of the organization on the leak site, the group has not provided specific details regarding the nature of the information they claim to have accessed. The announcement lacks any sample files or specific documentation that would clarify the scope of the breach.

• No specific data types or sample files were provided in the announcement.

As of the current reporting, there is no information available regarding the total volume of files involved or the specific size of the data allegedly exfiltrated during the incident.

About mactavishco.ca

MacTavish & Co. is a boutique retailer based in Medicine Hat, Alberta, Canada. The organization specializes in the sale of curated home décor products and various gift items, serving its customer base through a specialized retail model.

Impact and industry implications

The situation involving mactavishco.ca presents several significant risks. The use of the double-extortion method by Safepay means the company faces the dual threat of operational disruption and the potential publication of private information. Such a scenario can lead to a loss of customer trust and significant disruptions to the company's day-to-day operational processes. Furthermore, the threat of data publication can expose the organization to secondary risks, such as targeted phishing attacks against employees or customers.

From a regulatory perspective, as a business operating within Canada, any confirmed data leak may trigger specific legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). Compliance with these regulations is essential for managing the legal consequences of a data breach.

For organizations operating in the retail and e-commerce sectors, particularly small-scale businesses, this incident highlights potential vulnerabilities. Smaller retailers may often have more limited cybersecurity resources, making them targets for ransomware groups. To mitigate such risks, organizations in this sector can implement several defensive measures, such as maintaining robust offline backups, enforcing multi-factor authentication across all systems, and conducting regular security awareness training to defend against phishing attempts. Strengthening network monitoring and ensuring timely patching of software are also critical steps in reducing the attack surface available to threat actors like Safepay.