Proexequiales Resurgir listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Colombia
• Announcement date: January 15, 2025

The Safepay ransomware group has officially listed the Colombian entity proexequialesresurgir.com on its dedicated leak site. This announcement, made on January 15, 2025, indicates that the threat actor claims to have successfully infiltrated the organization's systems and exfiltrated data from their network.

The claimed attack and incident details

According to the announcement made by the Safepay group, the breach is linked to an intrusion that reportedly occurred on December 26, 2024. The threat actors claim to have gained unauthorized access to the internal systems of proexequialesresurgir.com, leading to the theft of information. While the group has publicly identified the victim on their leak site, they have not disclosed a specific ransom demand or a specific volume of data that was allegedly stolen during the operation.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public gallery where the group can list the names of organizations they have successfully compromised. By listing a target, the group aims to increase the pressure on the victim by threatening to release sensitive information to the public, a tactic frequently used to maximize the impact of their extortion attempts.

Data involvement and specifics

Regarding the specifics of the compromised information, the announcement provided no details concerning the nature of the data involved. The listing does not specify what types of files or information were exfiltrated from the organization's infrastructure. Furthermore, no screenshots or visual evidence of the stolen data have been provided by the threat actor to substantiate their claims.

In many modern cyberattacks, the lack of immediate detail regarding data types is common during the initial stages of a leak site listing. Organizations often face significant uncertainty during these periods as they attempt to determine the scope of the breach and whether the stolen information includes personally identifiable information (PII), financial records, or proprietary business documents.

About proexequialesresurgir.com

Proexequiales Resurgir is a company based in Colombia that operates within the funeral services sector. The organization provides essential support to families during sensitive times, handling funeral arrangements, burials, and various related logistical processes required for end-of-life services.

Analysis and potential risks

The Safepay group is reported to employ double extortion tactics. In a double extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information beforehand. The threat actors then threaten to leak this data on public forums or leak sites if the ransom is not paid. This approach significantly increases the pressure on the victim, as the threat of a data leak can cause irreparable reputational damage and legal consequences, even if the organization has robust backups to restore their systems.

This specific situation may lead to the unauthorized disclosure or public release of the organization's data. Such a leak could result in secondary risks, including identity theft or targeted phishing attacks directed at the organization's customers and employees. When sensitive personal or logistical information is exposed, attackers often use it to craft highly convincing social engineering campaigns.

Furthermore, the organization may face legal obligations under Colombian data protection regulations due to the potential exposure of sensitive information. As the Safepay group is noted to have emerged in late 2024, public information regarding their specific operational methods and patterns remains limited.

To defend against such threats, organizations typically focus on implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training. Monitoring for unauthorized data exfiltration and ensuring strict access controls are also fundamental components of a modern cybersecurity posture aimed at mitigating the impact of ransomware and extortion-based attacks.