Safepay lists mooregiles.com on leak site claiming data theft

• Ransomware group: Safepay
• Country: United States
• Sector: Manufacturing
• Announcement date: May 6, 2025

Safepay claims data theft against mooregiles.com

The ransomware group known as Safepay has listed mooregiles.com on their leak site, claiming to possess a significant amount of stolen information. According to the announcement made on May 6, 2025, the threat actors allege that they successfully breached the organization's systems. This development highlights the ongoing risks faced by specialized manufacturing entities in the current cyber threat landscape.

The group's claim suggests a prolonged period of unauthorized access. The threat actors allege that they gained access to the organization's systems on March 28, 2025. This implies that the attackers may have maintained presence within the network for several weeks before the public announcement was made on the leak site. Such a timeline is common in modern ransomware operations, where attackers often spend time conducting reconnaissance and lateral movement before executing the final stage of the attack.

Details of the alleged data exfiltration

While the group has publicly claimed responsibility for the incident, specific details regarding the nature of the leaked data have not been provided. The only information available regarding the stolen files is the mention of a 32 GB data package in the screenshot provided by the group. No specific details regarding the nature of the leaked data have been provided, other than the mention of a 32 GB data package in the screenshot.

Summary of claimed information

• Total claimed data size: 32 GB

The listing names no specific data types or individual file categories.

About mooregiles.com

Moore & Giles specializes in the design and production of high-quality leather and leather goods. The company provides luxury leather solutions for the furniture, interior design, and fashion industries. As a provider of high-end materials for various sectors, the organization operates within a specialized manufacturing niche.

Analysis and potential impact

Given the double-extortion tactics employed by the Safepay group, the alleged data leak may negatively impact the organization's operational continuity and commercial reputation. Double extortion is a strategy where threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish the data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or sensitive information.

As the organization is based in the United States, a potential data breach could trigger state-level data protection laws and regulatory investigations. The publication of this data may pose secondary risks such as identity theft or targeted phishing attacks for employees and business partners. Furthermore, the group's emergence in late 2024 suggests that their operations may still be evolving, which can make their tactics and demands unpredictable.

In such scenarios, it may be necessary for the organization to initiate a forensic investigation to determine the scope of the leaked data and to notify relevant stakeholders. Organizations in the manufacturing sector often face these risks due to the high value of their design specifications and client lists. Defensive measures typically involve robust network segmentation, continuous monitoring for unauthorized data transfers, and comprehensive incident response plans to mitigate the fallout of both operational downtime and data exposure.