Safepay ransomware group lists firstcambodia.com.kh on its leak site

• Ransomware group: Safepay
• Country: Cambodia
• Sector: Hospitality
• Announcement date: April 17, 2026

The ransomware group known as Safepay has listed First Cambodia Co., Ltd. on its leak site, alleging a data breach. This announcement, made on April 17, 2026, suggests that the organization has been targeted in a cyberattack aimed at exfiltrating sensitive information.

The claims made by Safepay

According to the announcement released by the Safepay group, the organization was targeted on January 24, 2026. The group claims to have gained unauthorized access to the network of First Cambodia Co., Ltd. and subsequently exfiltrated data from the system. While the group has not officially confirmed the specific methods used to breach the perimeter, the nature of the claim involves a significant intrusion into the organization's digital infrastructure.

In many such instances involving ransomware groups, the attackers may demand a ransom payment in exchange for not releasing the allegedly stolen information to the public. This tactic is a hallmark of modern cyber extortion, where the threat of data exposure is used as leverage against the victim organization. At this stage, the specific details regarding the ransom demand or the exact scale of the intrusion remain undisclosed by the group.

Details regarding the alleged data breach

Regarding the specifics of the information that was allegedly stolen during the intrusion, the provided records and available screenshots do not specify the nature of the exfiltrated data. The listing does not provide details concerning the volume of files or the specific types of data that the group claims to have in their possession.

Because the group has not provided a breakdown of the stolen files, the full scope of the information at risk remains unknown. This lack of transparency is common in the early stages of a leak-site announcement, leaving the victim organization to determine the extent of the compromise through internal forensic investigations.

About First Cambodia

First Cambodia is a leading IT services and system integration company headquartered in Phnom Penh, Cambodia. The company provides technology solutions and infrastructure support to various industries, serving as a critical component in the technological landscape of the region.

Analysis and potential implications

Given that the Safepay group employs a double-extortion strategy, there may be a risk that the organization's sensitive data could be publicly released. Double extortion involves both encrypting the victim's data to disrupt operations and stealing the data to threaten public exposure. This dual pressure significantly increases the risk profile for the targeted entity.

As an IT services provider, this incident involving First Cambodia could potentially impact a wide range of its clients through supply chain vulnerabilities. When a service provider that manages infrastructure and technology solutions is compromised, the breach can act as a gateway to the networks of their various clients. This creates a ripple effect where a single successful attack on a provider can lead to secondary risks for many downstream organizations.

Considering the sectors the company serves, secondary risks such as targeted phishing attacks and identity theft may emerge. If sensitive client information is leaked, attackers often use it to craft highly convincing social engineering campaigns. Furthermore, the organization might face legal and regulatory consequences under regional data protection frameworks. The necessity of complying with local laws regarding data breach notifications and consumer protection remains a critical concern for organizations in this position.

It is also worth noting the operational profile of the threat actor. The fact that the group has been active since late 2024 and does not utilize an affiliate program may suggest that the attacks are managed directly by the core group. This centralized management style can sometimes indicate a more focused and disciplined approach to targeting specific organizations.

General defensive considerations

To mitigate the risks associated with such breaches, organizations in the IT services sector often focus on strengthening their perimeter defenses and implementing robust monitoring to detect unauthorized access. Implementing zero-trust architectures and ensuring strict access controls can help limit the lateral movement of an attacker within a network. Additionally, maintaining comprehensive, offline backups and conducting regular incident response drills are essential steps for resilience against ransomware and data exfiltration attempts.