safepay ransomware group lists granjarinya.com on its leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: August 14, 2026

Spanish dairy producer listed by safepay ransomware group

The threat actor known as safepay has listed the Spanish organization granjarinya.com on its dedicated leak site. According to the announcement made on August 14, 2026, the group claims to have successfully compromised the organization's data and has subsequently initiated a countdown on their platform.

Details of the claimed incident

The timeline provided by the threat actor suggests that the initial incident occurred around July 20, 2026. By listing the company on a leak site, the group is employing common ransomware tactics designed to pressure the victim. In these scenarios, threat actors often use a countdown timer to create a sense of urgency, threatening to release stolen information to the public or to dark web forums if specific demands are not met.

Regarding the specifics of the breach, no information has been provided concerning the nature or volume of the allegedly compromised data. The listing does not specify the number of files involved or the total size of the data set. Furthermore, the group has not issued a specific ransom demand at this time. The information currently available in the public domain, such as screenshots provided by the attackers, contains only general descriptive information regarding the company's operations rather than details about the stolen files.

The organization profile

Granja Rinya is a family-owned company located in Albal, Valencia, Spain. The business has a long-standing history in the agriculture and food production sector, with its operations spanning three generations of livestock farming.

Risk assessment and industry implications

The potential publication of the organization's data poses significant risks concerning trade secrets and operational information. Because the organization is based in Spain, a confirmed data breach could trigger legal sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR).

The tactics used by the safepay group indicate the use of double extortion. This method involves not only encrypting the victim's systems to disrupt operations but also stealing sensitive data to use as leverage. This creates a dual threat: the organization faces immediate ransom pressure to restore operations and the long-term risk of sensitive data being sold to third parties on the dark web.

Furthermore, such incidents can create secondary risks for the broader supply chain. If sensitive operational or contact information is leaked, supply chain partners may become targets for secondary phishing attacks. Organizations in the agriculture and food production sector can mitigate these risks by implementing robust data protection measures, maintaining offline backups, and ensuring strict compliance with regional data privacy regulations to minimize the impact of potential leaks.