Relucent.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Technology
• Announcement date: July 7, 2025

Safepay claims data breach against relucent.com

The ransomware group known as Safepay has listed relucent.com on its leak site, claiming to possess a significant volume of stolen information. According to the announcement made by the group, the breach is linked to an attack that allegedly occurred on May 17, 2025. The listing was officially posted to the group's leak site on July 7, 2025.

Ransomware leak sites function as a platform for cybercriminals to exert pressure on their victims. By publishing information about a successful intrusion, these groups aim to damage the reputation of the targeted organization and coerce them into paying a ransom. This process often involves a transition from simple encryption to more aggressive tactics designed to maximize leverage over the victim.

Details of the alleged theft

The Safepay group has made specific claims regarding the scale of the data they have allegedly obtained from the organization's systems. While the group has provided the total volume of the data, they have not provided specific details regarding the nature of the alleged leaked data; only a total volume of 45 GB is mentioned. The listing does not specify the exact file count or the specific types of files involved in the breach.

In addition to the data volume, the group's announcement included a reference to the organization's annual revenue, which is stated as 8.2 million dollars. This type of information is often used by threat actors to demonstrate that they have conducted reconnaissance on the target's financial standing prior to or during the attack, potentially to calibrate their ransom demands.

Data summary

• Total claimed data volume: 45 GB

The listing names no specific data types or individual file categories.

Risk assessment and implications

Given that the Safepay group employs a double-extortion strategy, risks to the organization's operational continuity may arise. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt business operations but also steal sensitive information. They then threaten to leak this data on public forums if the ransom is not paid, thereby creating a secondary layer of pressure involving data privacy and regulatory compliance.

As the organization is based in the United States, obligations under state-level data breach notification laws and federal regulations may be triggered depending on the content of the leaked data. Furthermore, secondary risks such as identity theft or targeted phishing attacks against employees and customers may be observed following such an incident. When sensitive information is leaked, it can be used by other malicious actors to conduct highly convincing social engineering campaigns.

The information that the group does not operate an affiliate program may suggest that attacks could be conducted under more centralized control. Unlike many ransomware-as-a-service (RaaS) operations that rely on a wide network of independent affiliates to carry out attacks, a centralized model often implies a more coordinated approach by the core group members. For organizations in the technology sector, maintaining robust defensive measures is critical. These typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to mitigate the impact of such intrusions.