Safepay ransomware group lists cascobay.org on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Education
• Announcement date: July 7, 2025

The Safepay ransomware group has listed data on their leak site that they claim belongs to the domain cascobay.org. According to the announcement made on July 7, 2025, the threat actor claims to have compromised a significant amount of information belonging to the organization.

The details of the claim

The threat actor known as Safepay has announced that they have targeted the entity associated with the domain cascobay.org. In their leak site listing, the group asserts that the organization has a revenue of $1.1 million. The group claims that the attack took place on May 19, 2025. By posting this information on a public leak site, the group appears to be employing a double-extortion strategy. This method is a common tactic used by modern ransomware groups to increase pressure on an organization. In a double-extortion scenario, attackers not only encrypt the victim's systems to disrupt operations but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This creates a secondary layer of leverage, as the threat of data exposure can cause significant reputational and legal damage even if the organization can restore its systems from backups.

Data involved in the incident

Regarding the specifics of the breach, the group has provided limited information concerning the stolen files. The listing claims that 10 GB of data has been compromised. However, no specific details regarding the content of the leaked data have been provided, other than the stated size of 10 GB. The listing names no specific data types.

Organization profile

Casco Bay High School is a public high school located in Portland, Maine, United States. It is known for its project-based learning model and operates under the Portland Public Schools district.

Impact and organizational considerations

This incident may negatively impact the organization's operational continuity and reputation. As the entity is based in the United States, the presence of personal information within the leaked data could trigger legal proceedings under state-level data protection laws and sectoral regulations. The double-extortion method used by the Safepay group may increase the risk of data publication or sale, which could potentially lead to identity theft and phishing attacks against the organization's stakeholders.

When organizations face such threats, they often need to initiate forensic investigations to determine the scope of the breach and evaluate notification obligations under relevant regulations. In the education sector, protecting student and staff information is a critical priority. Common defensive steps for organizations in this sector include implementing robust access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Furthermore, because the threat of phishing increases following a data leak, organizations must remain vigilant against social engineering attempts targeting their staff and students.