safepay ransomware group lists azpiaran.com on its leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Manufacturing
• Announcement date: May 15, 2025

The Spanish-based manufacturing company azpiaran.com has been listed on a leak site by the ransomware group known as safepay. The group has claimed responsibility for a cyberattack against the organization, alleging that they have successfully compromised the institution's systems.

Details of the claimed attack

According to the announcement made by the safepay group on May 15, 2025, the group claims to have targeted azpiaran.com. The group alleges that the breach occurred around May 9, 2025. This type of activity is characteristic of modern ransomware operations, where threat actors move beyond simple encryption to focus on data theft to increase their leverage over the victim.

The group utilizes a method often referred to as double extortion. In this tactic, attackers do not merely lock the victim's files behind encryption; they also exfiltrate sensitive information from the network. This allows the attackers to threaten the victim with the public release of their data if a ransom is not paid, creating a secondary layer of pressure that targets the organization's reputation and legal standing.

Data involved in the incident

The safepay group has claimed that a significant amount of data was taken during the incident. Specifically, the group alleges that 151 GB of data has been exfiltrated from the organization's systems. While the total volume of the data has been specified, the specific content and nature of the leaked files have not been disclosed by the attackers. The information provided by the group via screenshots only offers details regarding the total size of the data volume.

• No specific data types were listed in the announcement.

About azpiaran.com

Azpiaran is an industrial manufacturing group that specializes in various advanced metalworking technologies. Their expertise includes progressive stamping, fine blanking, transfer stamping, and forming technologies. The company serves as a key provider in the supply chain, producing metal components specifically for the automotive sector as well as various other industrial sectors.

Analysis and potential impact

The implications of this incident are significant due to the nature of the manufacturing sector. Given that the institution operates in this field, the leaked data may contain sensitive information such as trade secrets, technical drawings, or employee information. Such data is critical to the operational integrity and competitive advantage of industrial firms.

Furthermore, because the organization is based in Spain, any confirmed data breach involving personal information could lead to legal sanctions under the EU General Data Protection Regulation (GDPR). The use of double extortion tactics by safepay increases the risk that the stolen data will be published or sold on the dark web, which could impact the institution's operational continuity and create secondary attack risks for third parties within their supply chain.

The safepay group, which emerged in late 2024, currently has a limited amount of public information available regarding its specific operations and infrastructure. For organizations in the manufacturing sector, maintaining robust security postures is essential to mitigate these risks. This typically involves implementing strict access controls, continuous monitoring of network traffic for unusual exfiltration patterns, and ensuring that technical documentation and proprietary designs are stored in segmented, highly secure environments to prevent unauthorized access.