Safepay ransomware group lists cityofmarlow.com on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Government & Defense
• Announcement date: December 11, 2024

The Safepay ransomware group has listed cityofmarlow.com on their leak site, alleging that they have compromised the organization's data. This announcement marks a potential significant security incident for the local government entity, as the group claims to have gained unauthorized access to the organization's internal systems and information.

Details of the alleged attack

According to the claim made by the Safepay group, the incident occurred on November 27, 2024. The group subsequently posted the organization on their leak site on December 11, 2024. The group is described as an entity that employs double-extortion tactics. In such scenarios, threat actors typically engage in two stages of pressure: first, they encrypt the victim's data to disrupt operations, and second, they threaten to leak sensitive information on public forums if a ransom is not paid. This dual approach increases the pressure on the target to comply with financial demands.

While the group has made these claims, the specific details regarding the nature of the leaked data have not been provided. No screenshots or specific descriptions regarding the content of the data have been released by the group at this time.

The affected organization

The target of this alleged attack is the City of Marlow, a local government entity located in Buckinghamshire, England. This organization is responsible for managing the town's administrative affairs, local services, and maintaining public order within its jurisdiction.

Impact and security implications

The claims made by the Safepay group may lead to operational disruptions and reputational damage for the organization. Although the content of the leaked data remains unclear, such breaches targeting public sector entities may involve the exposure of sensitive citizen information. For organizations operating in the United Kingdom, this could potentially result in violations of data protection obligations under the UK GDPR. The subsequent publication of data may trigger secondary risks such as identity theft or targeted phishing attacks.

Public information regarding this specific group remains limited, making it difficult to determine their full scope or typical methods. For organizations in the government and defense sector, maintaining robust cybersecurity frameworks is essential to mitigate these risks. Common defensive strategies often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for staff to prevent initial access through phishing.

Summary of the incident

• Target: cityofmarlow.com
• Ransomware group: Safepay
• Claimed attack date: November 27, 2024
• Announcement date: December 11, 2024
• Type of threat: Data breach via double extortion