safepay ransomware group lists gayafores.es on its leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: September 8, 2026

Gayafores listed on safepay ransomware leak site

The Spanish ceramic manufacturer Gayafores has been listed on a leak site belonging to the ransomware group known as safepay. The announcement, which appeared on September 8, 2026, suggests that the organization has been targeted in a cyberattack involving a potential data breach.

The claimed attack details

According to the announcement published by the safepay group, the attackers claim to have gained access to the operational data of Gayafores. The listing was made on September 8, 2026, which coincides with the date the group claims the attack took place. While the group has published an announcement regarding the breach, the details provided in the post remain limited to general information concerning the operations of the company.

Ransomware groups often use leak sites to pressure victims into paying ransoms. These sites serve as a public gallery where groups post information about their targets to increase visibility and pressure. In this specific instance, the group has not disclosed a specific ransom demand, nor have they provided any details regarding the volume of data that has been allegedly compromised.

Data and information involved

The nature of the data allegedly leaked by the safepay group has not been specified in the announcement. The group has not provided details regarding the specific types of files or the total size of the data they claim to have acquired from the organization.

• No specific data types were named in the listing.

About Gayafores

Gayafores is a well-established ceramic manufacturer located in Onda, Castellón, Spain. Founded in 1949, the company has a long history in the industry and specializes in the design and production of ceramic tiles.

Analysis and potential implications

The safepay group is known to employ a double-extortion strategy. In such scenarios, attackers do not merely encrypt a victim's systems but also steal sensitive data, threatening to leak it publicly if a ransom is not met. This method increases the pressure on an organization, as the threat shifts from operational downtime to the exposure of private information.

Because Gayafores operates within Spain, the potential exposure of sensitive information could lead to legal consequences under the General Data Protection Regulation (GDPR) regarding the protection of personal data. Furthermore, the publication of such data could result in a loss of trust among the organization's customers and supply chain partners. There is also a risk that any leaked information could be utilized by malicious actors for targeted phishing attacks or identity theft.

In the manufacturing and food production sectors, maintaining the integrity of operational and commercial data is vital for supply chain stability. Organizations in these sectors often focus on robust defensive measures to mitigate these risks, such as implementing strict access controls, maintaining offline backups, and conducting regular security audits to protect sensitive commercial and employee information from unauthorized access.