safepay ransomware group lists artcitydental.com on its leak site

• Ransomware group: safepay
• Country: United States
• Sector: Healthcare
• Announcement date: December 17, 2025

Art City Dental targeted by safepay ransomware group

The US-based dental clinic artcitydental.com has been listed on the leak site of the ransomware group known as safepay. This listing, which appeared on December 17, 2025, constitutes an allegation of unauthorized access to the institution's systems. The threat actor is currently threatening to publish the organization's data, a tactic frequently used by modern cybercriminals to exert pressure on their targets.

Details of the alleged attack

According to the announcement made by the safepay group, the incident was reported on December 17, 2025. The group's claim involves an alleged intrusion into the systems of the dental clinic. While the group has officially listed the organization on its public leak site, the specific details regarding the method of entry or the exact timing of the initial breach remain undisclosed in the announcement.

Regarding the specifics of the information involved in this incident, the announcement provides no information regarding the type or scope of the data allegedly leaked. There is no mention of the total amount of data stolen or the specific number of files involved in the breach.

About Art City Dental

Art City Dental is a family-oriented dental clinic located in Springville, Utah. The institution provides general dentistry services to its community.

Analysis and potential implications

This incident indicates that a healthcare institution may face the risk of exposure of sensitive patient data. If the data is published, legal sanctions and administrative processes under HIPAA regulations may be triggered. The safepay group, which employs double extortion tactics, may be aiming to pressure the institution by threatening to release the data.

Double extortion is a common strategy used by ransomware groups where, after encrypting a victim's files, the attackers also steal sensitive information to use as leverage. By threatening to leak this information on a public platform, the attackers attempt to maximize the pressure on the organization to pay the ransom, as the threat of a public leak can cause significant reputational and regulatory damage.

This situation could lead to secondary risks such as identity theft and targeted phishing attacks for the institution's patients. When sensitive healthcare information is compromised, patients often become targets for subsequent social engineering campaigns or fraudulent activities. Public information about the safepay group remains limited, making it difficult to ascertain their full operational patterns.

For organizations operating within the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. To defend against such threats, organizations typically focus on implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Furthermore, maintaining offline, encrypted backups and implementing strict access controls are essential steps in mitigating the impact of unauthorized access and ransomware deployment.