Safepay ransomware group lists capsum.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Manufacturing
• Announcement date: December 19, 2025

Safepay claims a ransomware attack against Capsum

The ransomware group known as Safepay has listed capsum.com on its leak site, claiming to have compromised the organization's data. This announcement, made on December 19, 2025, indicates that the group claims to have conducted a ransomware attack against the organization on the same day.

The group is reportedly employing a double-extortion tactic. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the institution's data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of their proprietary or private information.

The publication of such a notice on a leak site may indicate potential risks to the organization's operational processes. As the group continues to evolve, the threat of data exposure remains a significant concern for targeted entities.

Details regarding the alleged data breach

Despite the claim of a successful compromise, the announcement remains vague regarding the specifics of the stolen information. No specific details or file lists regarding the content of the allegedly leaked data have been provided in the announcement. The listing does not specify the volume of data taken or the specific file count involved in the incident.

• No data types were specified in the listing.

About Capsum

Capsum is a global contract manufacturer in the beauty and cosmetics industry, specializing in microfluidic technology. The company develops innovative formulations for cosmetic products using patented scientific processes.

Analysis and potential implications

The double-extortion tactic used by the Safepay group may increase the risk of the organization's sensitive commercial and operational data becoming public. Given the organization's operations in France and the United States, a potential data breach could trigger legal proceedings under GDPR and relevant local data protection regulations. The exposure of such data can lead to significant reputational damage among the organization's supply chain partners and customers.

Furthermore, if the stolen data includes employee or customer information, it could be utilized for identity theft or targeted phishing attacks. Such secondary attacks often follow a primary breach, as the stolen credentials or personal details provide a roadmap for further exploitation of the individuals involved.

The fact that the Safepay group emerged in late 2024 may suggest that its operations are still evolving and its attack methods could be subject to change. As these groups mature, their techniques for infiltration and extortion often become more sophisticated.

For organizations operating in highly specialized manufacturing sectors, maintaining robust cybersecurity postures is essential. This includes implementing strict access controls, conducting regular audits of data handling processes, and ensuring compliance with international data protection standards to mitigate the impact of potential leaks. Protecting intellectual property, such as patented scientific processes, is particularly critical for companies in the cosmetics and chemical manufacturing industries.