Norpak.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Canada
• Sector: Technology
• Announcement date: July 18, 2025

Safepay claims data exfiltration against norpak.com

The Safepay ransomware group has officially listed the organization norpak.com on its dedicated leak site. According to the announcement made on July 18, 2025, the threat actor group claims to have successfully conducted a ransomware attack against the company, alleging that the breach occurred around June 30, 2025. The group is currently employing a double-extortion tactic, a method where attackers not only encrypt an organization's systems but also threaten to release sensitive stolen information publicly to increase pressure for a ransom payment.

The listing serves as a public notification of the alleged incident. In such scenarios, ransomware groups often use their leak sites to demonstrate the success of their operations and to exert psychological and financial pressure on the victim. By making the breach public, the group aims to damage the target's reputation and force a response through the threat of widespread data exposure.

Details of the claimed incident

The Safepay group has provided several specific claims regarding the scale and impact of the alleged attack. The group asserts that the organization in question has an annual revenue of 5.5 million dollars. This information is often used by ransomware groups to gauge the potential financial capacity of a victim and to justify their ransom demands, although no specific ransom demand was mentioned in the current listing.

Regarding the stolen information, the group claims to have exfiltrated a significant amount of data. The specifics of the content are as follows:

• The total size of the claimed exfiltrated data is 20.5 GB.
• The data is identified as being contained within a 20.5 GB ZIP file.

There is no specific information regarding the nature of the leaked data; it is only identified as a 20.5 GB ZIP file. The listing names no specific data types, such as customer databases, financial records, or employee credentials.

The target organization

The target of this alleged attack is norpak.com, a company operating within the technology sector. Based in Canada, the organization is subject to the regulatory landscape governing data privacy in that jurisdiction. Because the organization is Canadian, the incident may trigger data breach notification obligations under PIPEDA regulations, depending on the nature of the data involved and the impact on individuals.

Analysis and industry implications

The actions taken by the Safepay group could have significant consequences for the organization. Such incidents can negatively impact operational continuity and the overall reputation of the company. While the exact contents of the leaked data remain unconfirmed, the potential exposure of employee or customer information could pose secondary risks to the organization and the individuals involved.

Safepay is a group that emerged in late 2024. It is noted for its specific operational style, as the group is known for conducting direct attacks without the use of an affiliate program. This distinguishes them from many other ransomware-as-a-service (RaaS) models where various affiliates carry out attacks on behalf of a central developer. By operating directly, the group maintains tight control over its targets and the subsequent extortion process.

For organizations in the technology sector, this incident highlights the ongoing threat posed by double-extortion tactics. To mitigate these risks, companies often implement various defensive strategies, such as robust data encryption, strict access controls, and comprehensive monitoring of data egress to detect unauthorized transfers. Furthermore, maintaining a clear incident response plan and ensuring compliance with regional data protection laws, such as PIPEDA, are essential steps for managing the fallout of a potential breach and fulfilling legal obligations to notify affected parties.