Safepay ransomware group lists albertaindustrialcontrols.com on its leak site

• Ransomware group: Safepay
• Country: Canada
• Sector: Manufacturing
• Announcement date: August 19, 2025

Safepay claims a data breach at Alberta Industrial Controls & Drives Inc.

The threat actor known as Safepay has listed Alberta Industrial Controls & Drives Inc. on its dedicated leak site. According to the announcement posted on the platform, the organization has been targeted in a cyberattack. The group claims to have utilized double-extortion tactics to compromise the entity, alleging that they have successfully exfiltrated data from the organization's systems.

The announcement regarding this incident was created on August 15, 2025. However, the threat actor claims that the actual attack against the organization occurred much earlier, specifically on June 27, 2025. This discrepancy between the date of the attack and the date of the public listing is a common occurrence in ransomware operations, where actors may hold data for an extended period before making a public claim.

Details regarding the alleged incident

The Safepay group has made several claims regarding the nature of their operation against the Canadian firm. By listing the organization on their leak platform, the group is employing a high-pressure tactic designed to pressure the victim into meeting their demands. In this instance, the group alleges that they have successfully exfiltrated data through a double-extortion method. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information beforehand to threaten its public release.

Regarding the specific content of the breach, the group has not provided any specific details regarding the content of the allegedly exfiltrated data. Furthermore, no information was provided regarding the total size of the data stolen or the specific number of files involved in the theft. The group has also not issued a specific ransom demand in the current listing.

Organization profile

Alberta Industrial Controls & Drives Inc. is a Canada-based company specializing in the distribution of industrial electronic control systems, motors, and drives. Operating out of Edmonton, Alberta, the firm provides industrial automation and control equipment.

Potential impact and security considerations

This incident may lead to disruptions in the organization's operational processes and damage its commercial reputation. Because the organization operates in Canada, there is a possibility that data privacy obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) may have been violated. The use of double-extortion tactics by the Safepay group may bring about secondary risks, such as the publication or sale of the exfiltrated data on the dark web.

Risks to stakeholders

The potential for employees and customers to be exposed to identity theft or targeted phishing attacks should be considered following such a breach. When sensitive organizational data is exfiltrated, it can be used by malicious actors to craft highly convincing social engineering campaigns against the company's partners and staff.

General defensive context

While public information regarding the Safepay group is limited—as the group only emerged in late 2024—this incident highlights the ongoing risks faced by the manufacturing and industrial automation sectors. Organizations in these sectors often manage critical infrastructure components, making them high-value targets for ransomware groups. To mitigate such risks, organizations typically focus on robust backup strategies, network segmentation, and continuous monitoring of their environments to detect unauthorized data exfiltration attempts early in the attack lifecycle.