Safepay ransomware group lists globexusa.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Transportation
• Announcement date: February 3, 2025

Safepay claims compromise of Globex USA

The Safepay ransomware group has officially claimed responsibility for a cyberattack targeting Globex USA. According to an announcement made on the group's leak site, the threat actors have listed the organization as a victim of their operations. This development highlights the ongoing risks faced by logistics and supply chain entities in the current threat landscape.

The announcement was posted on February 3, 2025. While the listing serves as a public claim by the threat actor, the specific details regarding the breach remain limited to the group's own statements. Ransomware leak sites are frequently used by cybercriminal groups to pressure victims into paying ransoms by threatening to release sensitive information to the public or to dark web forums.

Details of the claimed attack

According to the claims made by the Safepay group, the unauthorized access to the organization's systems occurred on January 19, 2025. This indicates that the threat actors may have had access to the network for a period of time prior to the public announcement on their leak site.

The group has indicated that they may employ a double-extortion strategy in this incident. In a double-extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. The goal is to demand a ransom not just for the decryption of files, but also to prevent the subsequent publication of the stolen data. If the ransom is not met, the group threatens to release the data online, causing significant reputational and regulatory damage.

Data involved in the incident

At this time, no information or screenshots regarding the nature of the leaked data have been provided by the Safepay group. The listing does not specify the volume of files or the specific types of data that were allegedly accessed during the intrusion.

About Globex USA

Globex USA is a logistics and shipping services provider based in the United States. The company operates in the fields of international trade and supply chain management, making it a critical component in the movement of goods and services across borders.

Analysis and potential impact

The use of double-extortion by the Safepay group creates a high-risk scenario for the organization. If the group follows through on its threats, the publication or sale of the organization's data could lead to severe consequences. Because Globex USA is based in the United States, a confirmed data breach could trigger state-level data protection laws and various notification requirements for the company to fulfill.

Depending on the content of the data, the exposure of employee or customer information could lead to identity theft and targeted phishing attacks. Such attacks often follow a breach, where criminals use the stolen information to craft highly convincing messages to deceive individuals or other organizations.

Public information regarding the Safepay group remains limited, making it difficult to determine their full scope of operations. However, their ransomware activities can negatively impact an organization's operational continuity and overall reputation. For organizations in the transportation and logistics sector, maintaining robust cybersecurity defenses is essential to protect the integrity of the supply chain and ensure the privacy of sensitive trade and personal information.

• Operational continuity: Ransomware attacks can halt logistics operations, causing delays in shipping and international trade.
• Regulatory compliance: Data breaches often necessitate compliance with complex legal frameworks regarding data protection.
• Reputational risk: Publicly listing a company on a leak site can damage trust with international trade partners and customers.