safepay ransomware group lists cromados.com on its leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Manufacturing
• Announcement date: September 28, 2026

Safepay ransomware group claims attack on cromados.com

The safepay ransomware group has officially listed the Spanish manufacturing company cromados.com on its dedicated leak site. According to the announcement made on September 28, 2026, the threat actors claim to have successfully compromised the organization's data. This development marks a significant escalation in the pressure being applied to the company by the cybercriminal group.

The group is reportedly employing a double-extortion strategy in this incident. In a typical double-extortion scheme, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then threaten to publish this stolen information on a public leak site unless a ransom is paid. This method is designed to maximize leverage by threatening the victim's reputation and legal standing through the potential exposure of confidential information.

The announcement posted by the group includes general information regarding the operations of the company. This inclusion of corporate details suggests that the threat actor's primary intent is to exert maximum pressure on the organization to compel them to meet the group's demands.

Details regarding the alleged data breach

While the safepay group has claimed to have compromised the company's data, the announcement remains vague regarding the specifics of the theft. No specific information regarding the content of the allegedly compromised data has been provided by the attackers. Furthermore, the group has not disclosed the total size of the data stolen or the specific number of files involved in the breach.

The listing names no specific data types that have been compromised.

About cromados.com

Cromados is a Spanish industrial company that specializes in several critical metal processing techniques. The organization focuses on metal surface treatment, heat treatment, and various electrolytic coating processes. Through these specialized services, the company provides a wide range of industrial coating solutions designed for the protection and enhancement of metal parts used in various industrial applications.

Risk assessment and implications

This incident may pose significant risks to the organization's operational continuity and its commercial reputation. Because the company is based in Spain, a confirmed data breach could lead to serious legal consequences. Specifically, the organization may face legal sanctions and the requirement to fulfill mandatory breach notifications under the General Data Protection Regulation (GDPR).

The use of the double-extortion method by the safepay group indicates that the company may be pressured to pay a ransom under the constant threat of data publication. If the compromised data were to include sensitive information belonging to employees or customers, it could significantly increase the risk of secondary attacks or identity theft against those individuals.

The safepay group emerged in late 2024, and their operations appear to be still evolving. This suggests that similar attacks may continue as the group refines its tactics. For organizations operating in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures often include maintaining offline backups, implementing strict access controls, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. As threat actors continue to evolve, industrial companies must remain vigilant against the growing threat of sophisticated ransomware groups.