Safepay ransomware group lists divgroup.eu on leak site

• Ransomware group: Safepay
• Country: Slovakia
• Sector: Technology
• Announcement date: July 16, 2025

Safepay claims a data breach against divgroup.eu

The threat actor known as Safepay has listed the Slovakian technology company divgroup.eu on its dedicated leak site. This announcement, made on July 16, 2025, involves a claim of a significant data breach. The group alleges that the attack occurred around June 3, 2025, and they have initiated a countdown timer, which suggests a potential deadline for the publication of the stolen information if their demands are not met.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By publicly listing an organization, these groups aim to damage the victim's reputation and create urgency. In this specific instance, the group has included financial details alongside the listing, noting that the targeted organization has an annual revenue of 6.8 million dollars. This tactic is often used to demonstrate that the attackers have researched the victim's financial capacity to gauge the likelihood of a ransom payment.

Details of the claimed data theft

Regarding the specifics of the compromised information, the group has provided limited details. The listing does not specify the exact nature or the specific types of files that have been exfiltrated from the organization's systems. The information provided by the threat actor is restricted to the volume of the data involved.

• The total size of the claimed stolen data is 75 GB.

Because the group has not provided a specific list of file types or categories, the exact content of the 75 GB remains unknown. The group's reliance on a countdown timer indicates that the threat of data exposure is imminent, a common characteristic of modern ransomware operations.

About divgroup.eu

DivGroup is a technology company based in Slovakia. The organization operates within the technology sector, focusing on several key areas including software development, IT consulting, and the provision of digital solutions. As a firm involved in software and IT services, the organization handles various digital assets and technical infrastructures necessary for its operations and client services.

Analysis and potential implications

The Safepay group appears to be employing a double extortion strategy. In such attacks, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. This creates a dual pressure: the victim must deal with the operational downtime caused by encryption and the reputational and legal risks associated with a public data leak.

There is a significant risk that the organization's sensitive data could be made public. If the stolen information is released, it could lead to identity theft or targeted phishing attacks directed at the company's employees and customers. Furthermore, because DivGroup is based in Slovakia, this incident may result in legal and administrative consequences under the European Union's General Data Protection Regulation (GDPR), which imposes strict requirements on how personal data is protected and reported following a breach.

An interesting observation regarding this threat actor is that the group does not appear to use an affiliate program. This suggests that the attacks might be directly coordinated by the Safepay group itself, rather than being outsourced to third-party affiliates. Such direct coordination can have a negative impact on an organization's ability to manage the incident and maintain operational continuity during the crisis.

For organizations operating in the technology and IT consulting sectors, maintaining robust security postures is essential to mitigate these risks. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits. Given the potential for GDPR-related consequences, ensuring compliance with data protection regulations and having a clear incident response plan is a critical component of modern cybersecurity defense strategies.