mccn.org listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Healthcare
• Announcement date: June 23, 2025

The Safepay ransomware group has listed mccn.org on its dedicated leak site, claiming to have successfully executed a cyberattack against the organization. According to the announcement made on June 23, 2025, the threat actor group alleges they have exfiltrated a significant amount of data from the target.

Details of the claimed attack

The Safepay group claims to have carried out a ransomware attack against mccn.org, with the official announcement appearing on their leak site on June 23, 2025. While the announcement was made in late June, the group alleges the actual attack occurred on June 6, 2025. In their public post, the group highlights the organization's annual revenue of $11.5 million, a common tactic used by ransomware operators to demonstrate the potential financial impact of the breach and to pressure the victim into paying a ransom.

The threat actors are currently employing a double-extortion strategy. This method involves two distinct layers of pressure: first, encrypting the victim's systems to disrupt operations, and second, threatening to publish the stolen, sensitive data on a public leak site if the ransom is not met. This approach is designed to maximize leverage by threatening the organization's reputation and legal standing through the exposure of confidential information.

Data involved in the incident

Regarding the specific content of the leaked information, there is no detailed information regarding the content of the leaked data. The group's announcement only specifies the total size and the organization's annual revenue. The listing names no specific data types.

Data summary

• Total claimed data size: 198 GB

Organization profile

MCCN (Mariposa Community Health Center) is a community health center providing healthcare services in southern Arizona. It offers primary care, dental health, and behavioral health services to the local population.

Risk assessment and industry implications

This incident presents a potential risk of exposure for sensitive data within the healthcare sector. Given that the organization is based in the United States, any data breach may lead to legal consequences and administrative fines under HIPAA regulations. The double-extortion method could threaten the organization's operational continuity, while the potential exposure of patient records may create secondary risks such as identity theft and targeted phishing attacks for individuals.

The emergence of the Safepay group in late 2024 suggests that they may be in a phase of testing new techniques or attempting to establish their presence within the cybercrime ecosystem. For organizations in the healthcare sector, such incidents underscore the necessity of robust defensive measures. Common defensive steps for organizations include maintaining offline backups, implementing strict access controls, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration.

The potential for secondary risks, such as identity theft, highlights why data protection is critical for healthcare providers. When sensitive patient information is compromised, the impact extends beyond the immediate operational disruption of the healthcare facility, potentially affecting the long-term security and privacy of the individuals served by the center. Organizations must remain vigilant against the evolving tactics used by ransomware groups to maintain their presence and increase their success rates.