Safepay ransomware group lists creativeunited.org.uk on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: March 30, 2025

Safepay claims a data breach against Creative United

The ransomware group known as Safepay has officially listed the domain creativeunited.org.uk on its dedicated leak site. This announcement, made on March 30, 2025, constitutes a claim of a successful cyberattack and subsequent data compromise against the organization.

According to the information provided by the threat actor, the group asserts that they have successfully compromised the data belonging to the organization. While the listing appeared on the group's platform, the provided evidence, including screenshots, does not contain any readable data samples or verifiable information regarding the specific activities or methods used by the group during the alleged incident.

Details of the alleged incident

The event was announced by the Safepay group on March 30, 2025, which coincides with the date they claim the attack took place. At this stage, the specific nature and technical details of the breach remain unverified. The group's announcement serves as a claim of unauthorized access to the organization's digital environment.

Regarding the specific information that has been targeted, the listing does not provide any information regarding the nature of the alleged leaked data. The content of the screenshots provided by the group is illegible, making it impossible to determine what specific files or databases may have been accessed. Consequently, the listing names no specific data types.

Organization profile

Creative United is a social enterprise based in the United Kingdom. The organization provides a variety of essential services to the creative industries and arts organizations, including business development, financial consultancy, and various support services. Their operational focus involves managing various programs and funding initiatives designed to enhance the sustainability of businesses operating within the arts and culture sector.

Risk assessment and industry implications

The situation presents significant risks due to the tactics employed by the Safepay group. This threat actor is known to utilize double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information with the intent to threaten the victim with its public release unless a ransom is paid. This approach significantly increases the pressure on the target organization.

Because of these tactics, there is a tangible risk that the organization's data may be published on the dark web. Such an event could trigger legal and regulatory obligations for the organization under the United Kingdom's General Data Protection Regulation (UK GDPR). Furthermore, the alleged breach may create secondary risks for the organization's employees and stakeholders, including the potential for identity theft or the execution of highly targeted phishing attacks.

The impact and scope of this specific attack remain uncertain. Publicly available information regarding the Safepay group is limited, as the group only emerged in late 2024. For organizations operating within the professional services and social enterprise sectors, maintaining robust defensive postures is critical. Common defensive strategies include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risks of phishing and unauthorized access.