rlc.es listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Technology
• Announcement date: January 23, 2026

Spanish logistics company rlc.es listed on safepay leak site

The Spanish logistics and freight transport company rlc.es has been listed on the leak site of the safepay ransomware group. The threat actor claims to have successfully gained access to the organization's data, marking a potential significant security incident for the logistics firm.

The claimed attack and extortion tactics

According to the announcement published on the safepay leak site on January 23, 2026, the group claims to have compromised the systems of rlc.es. The group's announcement followed an alleged initial access date of January 14, 2026. Upon publishing the listing, the threat actors initiated a countdown process, a common tactic used by ransomware groups to exert psychological pressure on a victim to meet ransom demands.

Ransomware leak sites serve as a public shaming mechanism used by cybercriminals. These platforms are used to host stolen data or to announce that an organization has been breached, often accompanied by a timer to increase urgency. This method is frequently part of a broader extortion strategy designed to force companies into paying ransoms to prevent the public release of sensitive information.

Details regarding the allegedly compromised data

At this time, there is no information regarding the nature or content of the allegedly leaked data in the provided records or the screenshot. The listing does not specify the volume of data stolen or the specific types of files that have been accessed by the threat actor.

• No specific data types have been identified in the listing.

In many modern ransomware attacks, groups employ what is known as double-extortion. In this scenario, the attackers do not just encrypt the victim's files to disrupt operations, but they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this data publicly, or selling it on the dark web, provides the attackers with additional leverage during negotiations.

About rlc.es

Operating under the name Rau Load Cargo, S.L. (RLC Transportes), rlc.es is a Spanish logistics and freight transport company. The organization provides specialized road transport and shipping services, playing a role in the movement of goods and logistics management.

Potential implications and industry risks

Given that the safepay group is known to employ double-extortion tactics, there may be a risk that the organization's operational data and employee information have been compromised. Because the organization is based in Spain, a potential data breach could lead to legal obligations under the European Union's General Data Protection Regulation (GDPR).

The organization's operation in the logistics sector may suggest that supply chain partners could also face secondary risks. In a highly interconnected industry like logistics, a breach in one company can potentially create ripples throughout the supply chain, affecting the data security and operational continuity of partners and clients.

The fact that the safepay group emerged in late 2024 may indicate that its methods are not yet fully analyzed, and its attacks could potentially have a wider impact. The publication of the organization's data may lead to identity theft or targeted phishing attacks against employees and customers.

To mitigate such risks, organizations in the logistics and technology sectors often implement defensive measures such as multi-factor authentication, regular offline backups, and continuous network monitoring. Furthermore, maintaining a robust incident response plan and ensuring compliance with regional data protection regulations are critical steps for managing the fallout of a potential breach.