Safepay ransomware group lists hanan-hov.co.il on its leak site

• Ransomware group: Safepay
• Country: Israel
• Announcement date: August 3, 2026

Safepay group claims attack on hanan-hov.co.il

The Safepay ransomware group has officially listed the Israeli-based organization hanan-hov.co.il on its dedicated leak site. This announcement, made on August 3, 2026, marks a significant escalation in the group's activities against the target. By appearing on their public leak site, the group is signaling a direct confrontation with the organization, a common tactic used by modern ransomware operators to publicize their successful intrusions.

The group claims to have successfully compromised the organization's data during the incident. This listing is widely interpreted as a strategic move by the threat actors to exert maximum pressure on the company. By making the breach public, the group aims to increase the visibility of the attack, potentially forcing the organization into a position where they feel compelled to meet specific demands to prevent further exposure.

This specific incident highlights the ongoing threat posed by ransomware groups that utilize public pressure as a primary weapon. The listing serves as a public declaration of the group's claim of compromise, though the specific details of the breach remain under the control of the attackers at this stage.

Details regarding the alleged data breach

While the Safepay group has announced the incident, they have not provided specific details regarding the content of the allegedly compromised data. There is currently no information available regarding the volume of data taken or the specific file types that may have been accessed by the attackers. The listing does not specify the total number of files or the specific nature of the information contained within the breach.

The listing names no specific data types that have been compromised.

In many such ransomware scenarios, attackers employ a method known as double extortion. In this tactic, the threat actors do not merely encrypt the victim's systems to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of leaking this stolen data on a public platform is then used as a secondary lever to coerce the victim into paying the ransom. This method ensures that even if an organization can restore its systems from backups, they still face the risk of public exposure and regulatory scrutiny.

About hanan-hov.co.il

Hanan Hov is a logistics company headquartered in Neve Yamin, Israel. The organization provides comprehensive logistics support services, catering to a variety of complex sectors. Their operational scope includes providing essential support for construction, infrastructure, industrial, and commercial projects.

Potential implications and organizational risks

This incident may result in the exposure of the company's operational data and client information. Because the organization is based in Israel, any potential data breaches may be subject to local data protection regulations, which could introduce legal and compliance complexities for the company. The double extortion method employed by the Safepay group could threaten both the operational continuity and the reputation of the organization.

The secondary risks associated with such a breach are significant. Leaked data could potentially be utilized by malicious actors for identity theft or for conducting highly targeted phishing attacks against the company's clients and partners. Such attacks often leverage the specific context of the leaked information to appear more legitimate and convincing to the targets.

Regarding the threat actor, information regarding the Safepay group remains limited. The group emerged in late 2024, and their specific motivations and technical methodologies are still being monitored by the security community. For organizations operating in the logistics and infrastructure sectors, maintaining robust cybersecurity postures is essential to mitigate these evolving threats. This includes implementing strong access controls, maintaining regular offline backups, and ensuring comprehensive monitoring of network activities to detect unauthorized data exfiltration early in the attack lifecycle.