safepay ransomware group lists groupepiche.ca on its leak site

• Ransomware group: safepay
• Country: Canada
• Sector: Professional Services
• Announcement date: February 7, 2026

Canadian construction firm listed by safepay

The Canadian construction firm Groupe Piché has been listed on the leak site of the ransomware group known as safepay. In an announcement published on February 7, 2026, the group claimed to have obtained data from the organization and has initiated a countdown process against the company.

Details of the claim

The announcement made by the safepay group on February 7, 2026, includes general information regarding the operations of Groupe Piché. However, the group has not yet provided any specific evidence regarding the details of the alleged attack. While the group has officially listed the organization on its leak site, the specific nature of the breach remains unverified by the source material.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host lists of targeted organizations and, in some cases, samples of stolen data to increase the pressure on the victim. The use of a countdown timer is a common psychological tactic employed by these groups to create a sense of urgency, suggesting that data will be released or further actions will be taken if demands are not met within a certain timeframe.

Data involvement

Regarding the information allegedly exfiltrated during this incident, the announcement provides no information regarding the nature or content of the data. The listing does not specify any particular data types or quantities involved in the claim.

Organization profile

Groupe Piché is a privately held Canadian construction and interior systems company. The organization maintains its operations through offices located in Ferme-Neuve and Boisbriand, Québec.

Analysis and potential implications

The tactics employed by the safepay group suggest the use of double-extortion. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method increases the pressure on the victim, as the threat of a data leak can cause significant reputational and regulatory damage even if the organization can restore its systems from backups.

Given the company's operations in the construction sector, this incident could potentially lead to the exposure of sensitive information, such as employee records, commercial contracts, and project details. Such an exposure could trigger data privacy obligations under Canada's PIPEDA, which may result in regulatory consequences for the organization. Furthermore, any leaked data could potentially be utilized by malicious actors for identity theft or as a component of supply chain attacks against the company's partners or clients.

The fact that the safepay group emerged in late 2024 suggests that its operational methods may still be evolving. Organizations facing similar threats often focus on defensive strategies such as implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for employees to mitigate the risk of initial access.