Safepay ransomware group claims data breach at planet-itservices.com

• Ransomware group: Safepay
• Country: India
• Sector: Technology
• Announcement date: May 21, 2025

Safepay claims data theft from planet-itservices.com

The Safepay ransomware group has officially listed the technology company planet-itservices.com on its leak site. According to the announcement made by the threat actors, the group has successfully targeted the organization and claims to have obtained access to a significant volume of data belonging to the firm.

The announcement was published on May 21, 2025. While the leak site announcement occurred in May, the group claims the actual attack took place on May 13, 2025. This timeline suggests a period of activity between the initial breach and the public disclosure of the theft. The group's decision to publish the victim's name on a dedicated leak site is a hallmark of modern ransomware operations, often used to exert pressure on the targeted entity.

Details of the claimed data theft

Regarding the specifics of the breach, the Safepay group has provided limited information concerning the exact nature of the files they have allegedly acquired. While the group has confirmed the scale of the incident, they have not provided specific details regarding the content or the specific types of files contained within the stolen dataset.

The following details have been provided by the threat actors:

• The total size of the claimed data package is 102 GB.

The listing does not specify the file count or the specific categories of information involved. The lack of detail regarding the content of the 102 GB package is common in many ransomware incidents, where the primary goal of the announcement is to signal the breach rather than provide a full inventory of the stolen assets.

About planet-itservices.com

Planet IT Services is an India-based technology and IT services company. The organization provides IT solutions and consulting services for various industries. As a provider of IT solutions and consulting, the company operates within the technology sector, serving a variety of different industrial clients.

Analysis and potential risks

The Safepay group, which emerged in late 2024, is known for employing double-extortion tactics. In a double-extortion scenario, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data beforehand. The goal is to threaten the victim with the public release of this data to increase the pressure to pay the ransom. This strategy shifts the focus from mere operational recovery to the mitigation of reputational and legal damage.

The potential exposure of the organization's data may pose risks to trade secrets and customer information. Furthermore, because the organization is based in India, it may face challenges regarding compliance with local data protection regulations following such a breach. There are also secondary risks to consider, such as the potential use of leaked data for identity theft or targeted phishing campaigns against the organization or its clients.

The absence of an affiliate program for this group may suggest that their attacks are conducted under more centralized control. This centralized structure can sometimes make a group more consistent in its tactics and communication.

For organizations operating in the technology and IT services sector, such incidents highlight the importance of robust defensive measures. Common defensive steps include maintaining rigorous backup protocols, implementing strict access controls, and conducting regular security audits to identify vulnerabilities. Protecting against double-extortion requires not only strong perimeter defenses to prevent initial access but also advanced data loss prevention (DLP) mechanisms to detect and stop unauthorized data transfers before they reach the scale of a major breach.