Safepay ransomware group lists horanbarker.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Professional Services
• Announcement date: July 22, 2025

The Safepay ransomware group has listed horanbarker.com on their leak site, claiming to have exfiltrated 62 GB of data from the organization. This announcement, categorized as a data breach, was posted on July 22, 2025, marking a significant development in the ongoing threat landscape involving professional service providers.

The details of the claimed attack

According to the threat actor known as Safepay, the organization was targeted in a cyberattack that is said to have occurred on June 4, 2025. The group added the firm to their leak site on July 22, 2025, following the alleged intrusion. In their public listing, the group also included financial information regarding the target, stating that the organization has an annual revenue of $5 million.

Ransomware groups often use leak sites to pressure victims into paying ransoms. These sites serve as a public gallery of successful breaches, where threat actors post information about their targets to increase visibility and pressure. The timing between the alleged attack in June and the listing in July suggests a period of data exfiltration and negotiation or preparation by the threat actors.

Data involved in the incident

Regarding the specific contents of the alleged breach, the group has not provided any details regarding the nature of the stolen data. The only specific information provided by the threat actor is the total size of the data, which is claimed to be 62 GB. The listing does not specify the number of files involved or the specific file types that were allegedly accessed during the incident.

The listing names no specific data types.

About horan barker

Horan Barker is a law firm based in Chicago. It provides professional services specializing in employment law, commercial litigation, and corporate consulting.

Risk assessment and implications

The use of double extortion tactics by the Safepay group may increase the risk of sensitive data being leaked. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's systems but also steal sensitive information, threatening to release it publicly if the ransom is not paid. This approach significantly increases the pressure on the victim, as the threat of a data leak can cause irreparable reputational and legal damage.

As the organization is based in the US, any potential data breach could lead to legal proceedings under state-level privacy laws and sectoral regulations. Furthermore, secondary risks such as identity theft or targeted phishing attacks may arise for the organization's employees and customers. The sensitive nature of legal services means that the data handled by such firms often includes confidential client information, which is highly valued by threat actors.

Public information about the Safepay group is limited; however, it is possible that the data may be made public if the ransom is not paid. Organizations in the professional services sector can take several defensive steps to mitigate such risks, including implementing robust encryption for data at rest and in transit, maintaining strict access controls, and conducting regular security awareness training for employees to prevent initial access through phishing.