Safepay claims data breach against mauilodging.com

• Ransomware group: Safepay
• Country: United States
• Sector: Hospitality
• Announcement date: August 8, 2025

Safepay lists alleged data belonging to mauilodging.com

The threat actor known as Safepay has listed data allegedly belonging to mauilodging.com on its leak site. According to the announcement, the group claims to have accessed a significant volume of information, totaling 14.5 GB. This listing serves as a public claim by the group regarding the successful targeting of the organization.

Details of the alleged attack

The Safepay group published an announcement on its leak site on August 8, 2025, targeting mauilodging.com. The threat actor claims to have accessed the data following an incident that allegedly occurred on August 1, 2025. While the exact nature of the initial intrusion has not been detailed, the group is employing a double-extortion strategy to exert pressure on the organization.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat actors then threaten to leak this stolen information on public forums or leak sites if the ransom is not paid. This approach increases the pressure on the victim, as the threat of a data breach can lead to significant reputational damage and legal consequences, even if the organization can restore its systems from backups.

Data involved in the claim

Regarding the specific content of the allegedly leaked data, there is no specific detail provided in the available records or screenshots. The listing only states that the data consists of a 14.5 GB ZIP file. The listing names no specific data types.

Organizational profile

Maui Lodging is a business providing vacation rental and accommodation services located on the island of Maui in the state of Hawaii, USA.

Implications and industry context

This alleged leak may pose risks to the organization's operational continuity and the privacy of customer data. As the organization is based in the US, a potential data breach could trigger legal obligations under state-level data protection laws and sectoral regulations. The use of the double-extortion method by the Safepay group may increase the likelihood that the leaked data could be utilized in secondary attacks or identity theft attempts.

For organizations in the hospitality sector, such incidents highlight the importance of robust data protection measures. Customers of the organization may need to be alerted to the risk of targeted phishing attacks, as stolen information is often used to craft convincing fraudulent communications. General defensive steps for organizations facing such threats include maintaining offline backups, implementing strict access controls, and monitoring for unauthorized data exfiltration.

Public information regarding the Safepay group, which emerged in late 2024, remains limited. The group's activities continue to present a challenge to organizations as they navigate the complexities of modern cyber extortion tactics.