Prais.ro listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Romania
• Sector: Technology
• Announcement date: May 17, 2025

The safepay ransomware group targets prais.ro

The technology firm prais.ro has been listed on the leak site of the safepay ransomware group. According to an announcement published on May 17, 2025, the threat actor known as safepay claims to have targeted the Romanian organization. The group alleges that the attack occurred on April 16, 2025, marking the beginning of the incident involving the company's digital assets.

In the announcement, the threat actor claims to be employing a double-extortion strategy regarding the company's data. Double extortion is a common tactic used by modern ransomware groups where, in addition to encrypting the victim's files to disrupt operations, the attackers also exfiltrate sensitive information. The goal of this method is to pressure the victim into paying a ransom by threatening to leak the stolen data publicly or sell it to third parties, thereby increasing the pressure on the organization to comply with financial demands.

Claims regarding the exfiltrated data

The safepay group has made specific claims regarding the volume of information they have allegedly obtained during the breach. While the group has not provided specific details regarding the content of the allegedly exfiltrated data, they have identified the format of the stolen information.

• The group claims to have exfiltrated a 5.3 GB ZIP file.

Aside from the file size and the format mentioned above, no further details regarding the specific contents of the data have been provided by the threat actor.

About prais.ro

PRAIS is a public relations, corporate communication, and sustainability consultancy agency based in Romania. The company provides strategic communication and corporate social responsibility project services to clients across various sectors. As a consultancy firm operating within the technology and communications space, the organization manages various strategic assets for its diverse client base.

Potential impact and organizational risks

This incident may negatively impact the company's operational continuity and reputation. Because the company is based in Romania, the potential data breach could lead to legal obligations and administrative sanctions under the General Data Protection Regulation (GDPR) within the European Union. The use of the double-extortion method by the safepay group may increase the risk of the company's data being made public or sold to third parties.

Furthermore, if the leaked data contains employee or customer information, it could lead to identity theft or targeted phishing attacks. Such attacks often follow a breach, where malicious actors use the stolen information to craft highly convincing messages to deceive individuals or other organizations.

Public information regarding the safepay group is limited, making it difficult to determine the full scope of their typical operations. In general, organizations facing such threats often focus on strengthening their defensive posture through robust backup strategies, continuous monitoring, and employee awareness training to mitigate the risks of unauthorized data exfiltration and subsequent extortion attempts.