Safepay ransomware group lists caredig.co.uk on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Healthcare
• Announcement date: July 7, 2025

The Safepay ransomware group has listed 31 GB of data allegedly belonging to the healthcare entity caredig.co.uk on its leak site. This announcement, made on July 7, 2025, marks a significant potential data exposure for the United Kingdom-based organization.

The claims made by Safepay

According to the announcement posted by the Safepay group, the organization caredig.co.uk was targeted in a cyberattack that allegedly took place on May 27, 2025. In their public listing, the group claims to have compromised a total of 31 GB of data. As part of their pressure tactics, the group also cited the organization's revenue, which is stated to be 17.2 million dollars.

The group has indicated their intention to publish or leak the mentioned data through their dedicated leak site. This behavior is characteristic of modern ransomware operations that utilize public pressure to coerce victims into meeting ransom demands. While the group has made these claims, the specific details regarding the exact nature of the breach remain limited to the information provided on their site.

Details regarding the alleged data breach

Regarding the specific content of the compromised information, there is no specific detail provided by the threat actor. The available information is limited to the scale of the theft rather than the contents of the files. The screenshot provided by the group only displays the total size of the data and the alleged financial revenue of the organization.

• Total data size: 31 GB

The listing names no specific data types or individual files that have been compromised.

About Caredig

Caredig is an organization providing housing and social care services in West Wales. It specializes in offering supported living and care solutions for the elderly and individuals with specific needs.

Analysis and implications for the sector

The situation involving Caredig highlights the risks associated with the double extortion tactics employed by the Safepay group. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive information to threaten its public release. This approach can lead to the public exposure of an organization's sensitive information, causing significant reputational and operational damage.

Given that the entity operates in the healthcare sector, the presence of personal health information or patient records could trigger legal consequences under the UK GDPR. The potential exposure of such sensitive data poses significant risks to the privacy of individuals. Furthermore, secondary risks may emerge for the organization's clients and employees, such as identity theft or targeted phishing campaigns. These follow-on attacks often leverage the information stolen during the initial breach to target individuals directly.

The Safepay group emerged in late 2024, and their activities might be in an early stage. This suggests that their operational methods could continue to evolve as they gain more experience. For organizations in the healthcare sector, maintaining robust cybersecurity postures is critical to mitigating these evolving threats. Defensive strategies typically include implementing strict access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration.