safepay ransomware group lists cheeky.com.ar on its leak site

• Ransomware group: safepay
• Country: Argentina
• Sector: Retail & E-Commerce
• Announcement date: April 17, 2026

The Argentine children's fashion brand Cheeky has been listed on the leak site of the ransomware group known as safepay. According to the announcement made on the group's platform, the organization has been targeted in a cyberattack, marking a new instance of data exposure involving a prominent retail entity in the region.

The claimed attack and group activities

The threat actor identified as safepay announced the listing of the Cheeky brand on its leak site on April 17, 2026. In the post, the group claims that the organization was subjected to a cyberattack occurring on February 5, 2026. This significant gap between the alleged intrusion and the public announcement is a common occurrence in ransomware operations.

The group appears to be employing a double-extortion strategy by publishing the organization's information. Double extortion is a tactic where threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release this data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of their proprietary or customer information.

Based on the group's operational patterns, safepay emerged in late 2024. Notably, this group does not utilize an affiliate program, which suggests that the group conducts its operations directly through its own infrastructure rather than through a distributed network of independent contractors.

Details regarding the alleged leaked data

Regarding the specifics of the breach, the post provided by the threat actor does not contain specific information regarding the nature of the alleged leaked data. No details were provided concerning the volume of files or the total size of the data allegedly exfiltrated during the incident. Furthermore, no ransom demand has been specified in the announcement.

The screenshot provided by the group contains only general descriptive information about the organization rather than specific datasets or sensitive files. The listing names no specific data types that have been compromised.

Organization profile

Cheeky is a well-established Argentine children's fashion brand operating under CHEEK S.A. The company provides design and retail services in the children's fashion sector, making it a notable player in the regional retail and e-commerce landscape.

Impact assessment and industry implications

This situation may cause disruptions in the organization's operational processes and potentially damage customer trust. When a retail brand faces such a public listing, the loss of reputation can be significant. Additionally, it is likely that the organization will face legal obligations under Argentine data protection regulations following such an event.

Due to the double-extortion method, it is assessed that the leaked data could create secondary risks and potentially pave the way for targeted phishing attacks against customers. In the retail sector, once customer information is compromised, attackers often use it to craft highly convincing fraudulent communications to steal further credentials or financial information.

To mitigate such risks, organizations in the retail and e-commerce sectors typically focus on robust data protection measures and incident response readiness. This includes implementing strong access controls, continuous monitoring of network traffic, and ensuring that all regulatory compliance requirements for data privacy are strictly met to minimize legal exposure.