Safepay ransomware group lists favellefavco.com on its leak site

• Ransomware group: Safepay
• Country: Malaysia
• Sector: Manufacturing
• Announcement date: April 17, 2026

The Safepay ransomware group has listed the Malaysian engineering firm favellefavco.com on its leak site, alleging that the organization has been the victim of a data breach. This announcement, made on April 17, 2026, marks a new development in the group's activities targeting industrial entities.

The claimed ransomware incident

According to the announcement posted by the Safepay group, the incident involving favellefavco.com was claimed to have occurred on February 24, 2026. The group's post serves as a public notification of the alleged attack, a common tactic used by modern ransomware operators to pressure victims into meeting their demands.

Safepay is a threat actor that has been active since late 2024. The group is recognized in the cybersecurity landscape for employing double extortion tactics. In a double extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site provides the attackers with additional leverage, as the victim faces the risk of reputational damage and regulatory scrutiny if the data is released.

Details regarding the alleged stolen data

The leak announcement provided by the Safepay group includes general information regarding the company's operations and services. However, the group has not provided specific information regarding the nature of the alleged stolen data. No details were provided concerning the total volume of data or the specific number of files involved in the breach.

The listing names no specific data types that have been compromised.

About Favelle Favco

Favelle Favco is a Malaysia-based engineering company. The organization specializes in the design and manufacturing of various heavy-duty cranes. Their product portfolio includes tower cranes, offshore cranes, and wharf cranes, serving critical infrastructure and industrial needs.

Potential impact and industry implications

Given the Safepay group's established use of the double extortion methodology, there is a possibility that the company's sensitive commercial data or employee information has been compromised. Such a breach could have significant consequences for the organization's operational continuity. Furthermore, an incident of this nature can create secondary risks for the company's various supply chain partners who may rely on the integrity of the organization's data and communications.

From a regulatory perspective, the company may face legal obligations under Malaysian data protection regulations, which could potentially lead to administrative sanctions. Additionally, there is the risk that any leaked data could be utilized by malicious actors in future identity theft or targeted phishing campaigns against the company or its stakeholders.

For organizations operating within the manufacturing and heavy engineering sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive strategies typically involve maintaining rigorous data backup protocols, implementing strict access controls to sensitive engineering designs and commercial records, and conducting regular security awareness training to mitigate the risk of phishing. Maintaining visibility into supply chain dependencies is also critical to managing the secondary risks associated with a partner's potential compromise.