Naxis.net listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Japan
• Sector: Technology
• Announcement date: July 22, 2025

The Safepay ransomware group has listed the Japanese technology company naxis.net on its dedicated leak site. According to the announcement made on July 22, 2025, the threat actor claims to have successfully exfiltrated a significant volume of data belonging to the organization.

The claims made by Safepay

The threat actor known as Safepay has officially announced a ransomware incident involving naxis.net. In the announcement posted on their leak site, the group claims to have obtained approximately 81 GB of data from the organization. While the claim was made on July 22, 2025, the group suggests that the attack itself took place around June 6, 2025.

Based on the nature of the announcement, it is suggested that the actor is employing a double-extortion strategy. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data beforehand. The threat actors then threaten to publish this stolen information on public leak sites if the ransom demands are not met, thereby exerting pressure through the threat of reputational damage and regulatory scrutiny.

Details regarding the alleged data breach

Regarding the specifics of the information allegedly stolen, the group has provided limited details. There is no detailed information regarding the content of the leaked data; the available information only indicates that the total size of the data is 81 GB. The listing names no specific data types or individual files.

Potential risks of data publication

The potential publication of this data could trigger secondary risks such as identity theft or targeted phishing attacks against employees and customers. When sensitive information is leaked, it often becomes a commodity for other cybercriminals who use it to conduct more sophisticated social engineering campaigns or fraudulent activities.

Organization profile

Naxis is a Japanese technology company that provides inventory management, Product Information Management (PIM), and digital asset management solutions for the retail and e-commerce sectors. The company develops software services aimed at increasing operational efficiency, particularly for businesses engaged in omnichannel sales.

Analysis and implications for the technology sector

The double-extortion tactic used by the Safepay group may pose significant risks to the organization's operational continuity and reputation. Depending on the nature of the alleged leaked data, legal obligations under Japan's Act on the Protection of Personal Information (APPI) may arise. This highlights the regulatory complexities faced by organizations when a breach occurs.

The fact that the group does not operate an affiliate program may suggest that their attacks are conducted with a more centralized and controlled strategy. Unlike many ransomware-as-a-service (RaaS) models that rely on a network of affiliates, a centralized approach often indicates a highly coordinated effort by the core group members.

Given the organization's presence in the technology sector, there may be a possibility that the leaked data includes intellectual property or technical infrastructure information. For companies providing critical software services like inventory and digital asset management, the loss of such information can be devastating to their competitive advantage and the trust of their clients.

To mitigate such risks, organizations in the technology sector often implement various defensive measures. These include robust encryption for data at rest and in transit, strict access controls to prevent unauthorized data exfiltration, and continuous monitoring of network traffic to detect unusual patterns. Additionally, maintaining a comprehensive incident response plan is essential for managing the legal and operational fallout of a successful extortion attempt.