Safepay ransomware group lists avgouleaschool.gr on its leak site

• Ransomware group: Safepay
• Country: Greece
• Sector: Education
• Announcement date: July 7, 2025

Safepay claims data breach at avgouleaschool.gr

The ransomware group known as Safepay has officially listed the Greek educational institution avgouleaschool.gr on its leak site. According to the announcement made on July 7, 2025, the threat actor group claims to have successfully breached the organization's systems and exfiltrated a significant amount of information.

Ransomware attacks often follow a pattern where attackers gain unauthorized access to a network, move laterally to locate sensitive information, and then extract that data to use as leverage. This specific incident involves a claim of data theft rather than a simple encryption event, highlighting the growing trend of data-centric extortion in the cybercrime landscape.

Details of the alleged attack

According to the claims made by the Safepay group, the breach occurred around June 14, 2025. The group asserts that they have obtained 43.3 GB of data from the institution. While the group has made a public announcement regarding the breach, they have not provided specific details regarding the content of the allegedly leaked data. The only information provided in the accompanying screenshot is the total size of the data and the name of the affected institution.

Interestingly, the group's announcement also included an estimate of the institution's annual revenue, a tactic often used by ransomware groups to pressure organizations by highlighting their financial capacity to pay a ransom. No specific ransom demand has been publicly disclosed in the listing provided by the group.

The target organization

The target of this alleged attack is Avgouleas-Linardou schools, a well-established private educational institution located in Athens, Greece. The school complex is known for providing a wide range of educational services, spanning from kindergarten to high school levels. The institution focuses on academic excellence and utilizes modern teaching methods to serve its student body.

Risks and implications of the incident

Given the double extortion tactics employed by the Safepay group, there is a significant risk that sensitive data could be published on the dark web. In a double extortion scenario, attackers not only encrypt the victim's data but also threaten to leak it to cause reputational and regulatory damage. For an educational institution, this poses a heightened risk because the leaked data may contain personal information belonging to students and staff members.

The potential consequences of such a breach are multifaceted. From a legal perspective, the exposure of personal data could lead to significant legal sanctions and administrative fines under the European Union's General Data Protection Regulation (GDPR). Beyond the immediate regulatory impact, the affected individuals—including students, parents, and employees—may face ongoing risks such as identity theft or targeted phishing attacks using the stolen information.

The Safepay group, which emerged in late 2024, appears to operate with a centralized structure, as they do not currently utilize an affiliate program. This organizational style can sometimes result in more consistent targeting patterns. To mitigate such risks, organizations in the education sector are encouraged to implement robust data protection frameworks, maintain strict access controls, and ensure comprehensive employee training to defend against the initial stages of an intrusion.