Radsports.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: May 29, 2025

Safepay claims data breach at radsports.com

The ransomware group known as Safepay has published an announcement on their leak site, claiming to possess a significant amount of data belonging to the e-commerce platform radsports.com. This announcement, categorized as a data leak, marks a new development in the group's activity targeting various organizations.

According to the claims made by the threat actor, the organization was compromised on May 2, 2025. The group subsequently listed radsports.com on their dedicated leak site on May 29, 2025. In their public statement, the group also noted that the organization has an annual revenue of $16 million, a detail often used by ransomware groups to gauge the potential financial impact of their extortion attempts.

Details of the claimed data theft

While the group has made a significant claim regarding the volume of information they have acquired, they have been unspecific regarding the exact nature of the stolen files. The announcement specifies the following regarding the alleged theft:

• The group claims to have obtained a dataset totaling 100 GB in size.

Beyond the total size of the data, no specific details regarding the content of the leaked data have been provided. No information was provided regarding the specific file count or the specific types of files contained within the 100 GB dataset. Furthermore, no ransom demand has been disclosed in the current announcement.

About radsports.com

Rad Sports is a retail and e-commerce company that specializes in the sale of sports equipment and accessories. As an entity operating within the retail and e-commerce sector, the company manages digital transactions and customer interactions through its online presence.

Analysis and implications of the Safepay threat

The Safepay group is identified as a ransomware entity that emerged in late 2024. The group is known to employ double extortion tactics. In a double extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. The threat of leaking this data on a public site is used to pressure the victim into paying a ransom, even if the organization has backups to restore their systems.

The group's claim of not utilizing an affiliate program is a notable characteristic, as it may suggest that their attacks are directly coordinated by the core group members rather than distributed through a network of independent contractors.

Such leaks can lead to the exposure of customer personal data, which potentially triggers legal proceedings under US data privacy regulations. Furthermore, the leaked data could potentially be used by malicious actors for identity theft or targeted phishing campaigns. The organization may face significant reputational damage in addition to operational disruptions resulting from the breach.

For organizations operating in the retail and e-commerce sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities before they can be exploited by ransomware groups.