Myer Auto listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Australia
• Sector: Manufacturing
• Announcement date: June 3, 2025

The ransomware group known as Safepay has officially listed the Australian organization Myer Auto on its dedicated leak site. According to the announcement made by the threat actors, the group claims to be in possession of a significant volume of data belonging to the automotive service provider.

Details of the claim

On June 3, 2025, the Safepay group published a notice on its leak platform targeting Myer Auto. The group claims to have successfully obtained 65 GB of data, which they allege belongs to the organization. This announcement was made on the same day as the claimed attack date. Notably, the group's post includes a countdown timer, a common tactic used by ransomware operators to pressure victims by indicating a scheduled time for the public release of the stolen information.

Data involved in the incident

Regarding the specific contents of the breach, the group has not provided detailed information. The available evidence, such as screenshots provided by the attackers, only indicates that the total size of the claimed data is 65 GB. The listing does not specify the exact file types or the nature of the information contained within the dataset.

The listing names no specific data types.

About Myer Auto

Myer Auto is an automotive service and repair center located in Australia. The organization provides a variety of essential automotive services, including vehicle maintenance, mechanical repairs, and general automotive services for its clientele.

Analysis and potential risks

The situation involving Myer Auto highlights several critical risks associated with modern ransomware operations. Because the Safepay group employs double-extortion tactics, the organization may face significant risks to its operational continuity. Double extortion is a strategy where attackers not only encrypt an organization's systems to disrupt business operations but also steal sensitive data to use as leverage during ransom negotiations. If the threat actors follow through on their threats, the publication of the data could lead to secondary risks, such as identity theft or targeted phishing attacks directed at the organization's employees or customers.

Furthermore, as an organization operating within Australia, this breach may trigger specific legal obligations under the Australian Privacy Act. Organizations facing such incidents must navigate complex regulatory landscapes to ensure compliance with national privacy standards. While the Safepay group is known to have emerged in late 2024, the full extent of its operational capacity and underlying motivations remains a subject for further analysis.

In response to such threats, organizations in the manufacturing and automotive service sectors often focus on strengthening their defensive posture. This typically involves implementing robust backup solutions to ensure operational continuity and enhancing monitoring capabilities to detect unauthorized data exfiltration. Maintaining strict access controls and conducting regular security awareness training are also standard defensive steps used to mitigate the impact of potential breaches and reduce the likelihood of successful phishing campaigns.