Safepay claims to have leaked data from lewis-manning.org.uk

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Healthcare
• Announcement date: July 7, 2025

Safepay announces data leak involving lewis-manning.org.uk

The ransomware group known as Safepay has published an announcement on its leak site claiming to have leaked data belonging to the United Kingdom-based healthcare organization lewis-manning.org.uk. This claim was made in a post dated July 7, 2025, involving a significant volume of information.

Details of the claimed attack

According to the announcement made by the threat actor, the data breach is linked to an attack that allegedly took place on May 24, 2025. The Safepay group, which is recognized as an entity that emerged in late 2024, is known for utilizing double extortion tactics during its operations. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's files to disrupt operations but also steal sensitive data to threaten the victim with its public release unless a ransom is paid.

The group has stated that the leaked data package is 30 GB in size. While the volume of the data has been specified, no specific details regarding the content of the leaked data have been provided by the group, other than the mention of the 30 GB data package. The listing does not provide information regarding the specific file count or the amount of a ransom demand.

The affected organization

The organization identified in the leak is lewis-manning.org.uk. Lewis-Manning Hospice Care is a charity based in Dorset, England, providing palliative care and support services to individuals with life-limiting illnesses and their families.

Analysis and potential implications

Given that the organization operates in the healthcare sector, it is possible that the alleged leaked data contains sensitive patient information or personal records. This situation may lead to compliance issues under the UK GDPR, which is the data protection legislation in the United Kingdom. The use of double extortion tactics by Safepay may increase pressure on the organization and potentially facilitate secondary risks such as identity theft or targeted phishing attacks.

Considering the known methods of the Safepay group, the publication of the data could create negative impacts on the organization's operational credibility. For organizations operating within the healthcare sector, maintaining data integrity and confidentiality is paramount to patient trust and regulatory standing.

General defensive considerations

While the specific details of this incident remain limited to the claims made by the threat actor, ransomware attacks on healthcare providers often highlight the necessity of robust cybersecurity frameworks. Organizations in this sector typically focus on several defensive pillars to mitigate such risks:

• Data encryption: Implementing strong encryption for data at rest and in transit to ensure that even if data is exfiltrated, it remains unreadable to unauthorized parties.
• Access controls: Enforcing the principle of least privilege to ensure that users and systems only have access to the data necessary for their specific roles.
• Regular backups: Maintaining offline or immutable backups to ensure operational continuity in the event of a ransomware encryption event.
• Employee training: Conducting regular security awareness training to help staff recognize and avoid phishing attempts, which are often the initial entry point for ransomware groups.

The emergence of groups like Safepay underscores the evolving nature of cyber threats, where the focus has shifted from mere system disruption to the strategic exploitation of sensitive information to maximize leverage over victims.