Safepay ransomware group lists camaravalencia.com on its leak site

• Ransomware group: Safepay
• Country: Spain
• Sector: Professional Services
• Announcement date: August 29, 2025

The Safepay ransomware group has listed the Spain-based Valencia Chamber of Commerce (camaravalencia.com) on its leak site. According to an announcement made by the threat actors, the institution has been targeted in a cyberattack, marking a new development in the group's recent activities.

Details of the claimed attack

The Safepay group claims to have compromised the institution's data in a post published on August 29, 2025. While the announcement was made in late August, the group's claim suggests the initial compromise may have occurred around June 30, 2025. In their public post, the attackers included general information regarding the institution's commercial activities and its organizational structure.

The group is currently employing a double-extortion tactic. In such scenarios, ransomware actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information during the initial stages of the intrusion. The threat of leaking this stolen data on a public forum is used as leverage to pressure the victim into paying a ransom. By threatening the publication of the alleged data, the group aims to maximize the impact of the breach on the victim's reputation and legal standing.

Data involved in the incident

Regarding the specific content of the alleged leaked data, no details have been provided by the group. The screenshot associated with the listing contains only general descriptive information about the institution rather than specific files or datasets. Consequently, the listing names no specific data types.

About the Valencia Chamber of Commerce

The Chamber of Commerce, Industry, Services and Navigation of Valencia is a public institution located in Spain. It serves a critical role in the Valencia region by supporting local businesses and promoting economic development. The organization provides various services specifically aimed at enhancing trade and supporting the commercial ecosystem within its jurisdiction.

Risk assessment and implications

The double-extortion tactic employed by the Safepay group may pose a significant risk of exposure for member and business partner data held by the institution. Given the institution's nature as a chamber of commerce, the leaked data might potentially include trade secrets or sensitive information belonging to member companies. This situation could create various risks for affected parties, such as identity theft or targeted phishing attacks.

Furthermore, as an entity operating in Spain, a potential data breach could lead to legal sanctions under the General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict data protection standards, and failures in securing sensitive information can result in substantial regulatory penalties. The fact that the Safepay group emerged in late 2024 may suggest that its operational methods and tactics are still evolving.

For organizations in the professional services and public sector, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive strategies include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. Monitoring for unauthorized data exfiltration and ensuring strict access controls can also help reduce the likelihood of a successful double-extortion attempt.