Safepay ransomware group lists globalmerchservices.com on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: May 6, 2026

Safepay claims a data breach against globalmerchservices.com

The ransomware group known as Safepay has officially listed the domain globalmerchservices.com on its dedicated leak site. This announcement, made on May 6, 2026, constitutes a claim of a successful data breach against the organization. By appearing on their leak platform, the threat actors are signaling their intent to utilize the information they claim to have acquired to pressure the victim.

Ransomware leak sites serve as a public stage for cybercriminals to exert psychological and financial pressure on targeted entities. These platforms are used to shame organizations into paying ransoms by threatening to release sensitive information to the public or to industry competitors. Such tactics are a hallmark of modern ransomware operations, moving beyond simple encryption to more complex forms of extortion.

Details of the claimed attack and extortion strategy

According to the announcement, the Safepay group claims to have successfully gained unauthorized access to the systems belonging to globalmerchservices.com. The group has indicated that they intend to employ a double-extortion strategy to achieve their objectives. In a double-extortion scenario, attackers do not merely encrypt the victim's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. This allows them to threaten the victim with the public release of stolen data if the ransom demands are not met, creating a secondary layer of leverage that targets an organization's reputation and legal standing.

The announcement made by the group on May 6, 2026, is viewed as a direct threat to the commercial operations of the organization. While the group asserts they have access to the systems, the specific methods used to infiltrate the network have not been detailed in the public claim.

Information regarding the compromised data

Regarding the specific content of the alleged breach, the group has not provided any details regarding the nature of the leaked or compromised data. The listing does not specify the volume of files involved or the total size of the data exfiltrated. Consequently, the listing names no specific data types.

About globalmerchservices.com

Global Merchandising Services (GMS) is an international company that specializes in the development and management of licensed merchandise. The firm focuses on artists and brands within the music, entertainment, and sports industries. Since its founding in 2008, the company has been responsible for managing commercial product strategies for a wide range of artists on a global scale.

Risk assessment and industry implications

The use of double-extortion tactics by Safepay poses a significant risk to the operational continuity of the organization. Because the target is based in the United Kingdom, any confirmed data breach could potentially trigger legal sanctions under the UK GDPR framework, which governs the protection of personal data and imposes strict requirements on how such data is handled and secured.

Furthermore, the specific nature of the organization's business introduces secondary risks. Given that GMS operates within the entertainment and licensing sector, the exposure of data belonging to third-party partners or artists could lead to significant downstream consequences. The involvement of high-profile artists and various commercial partners means that a breach could impact a wide network of stakeholders.

It is also worth noting that the Safepay group emerged in late 2024, suggesting that their operational methods and capabilities may still be evolving. For organizations operating in highly specialized sectors like licensing and entertainment, this evolution in threat actor behavior necessitates a proactive approach to security. To mitigate these risks, organizations often find it necessary to review their data security processes and implement robust defensive measures to protect against potential breaches and ensure the integrity of their commercial activities.