Safepay ransomware group lists hyperdomemedicalcentre.com.au on its leak site

• Ransomware group: Safepay
• Country: Australia
• Sector: Healthcare
• Announcement date: December 5, 2025

Safepay claims attack on Hyperdome Medical Centre

The ransomware group known as Safepay has officially listed Hyperdome Medical Centre on its leak site. According to an announcement made on December 5, 2025, the group claims to have compromised the Australian-based medical institution. The timing of the group's announcement suggests that an intervention against the institution's systems may have occurred around the same time the claim was published.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By listing an organization, these groups aim to damage the reputation of the target and coerce them into paying a ransom. In this instance, the Safepay group has shared details regarding the operations and healthcare services of the clinic as part of their public claim of a successful breach.

Details regarding the alleged data breach

While the group has identified the organization as a victim, specific technical details regarding the breach remain limited. At this time, there is no specific information available regarding the nature of the data allegedly compromised. The documentation provided by the group, such as screenshots, contains only a general description of the institution's services rather than specific file types or databases.

The listing names no specific data types that have been exfiltrated.

About Hyperdome Medical Centre

Hyperdome Medical Centre is a general practice clinic located in the South.Point shopping centre in Greenway, Tuggeranong, Australia. The facility provides general medical and healthcare services to the local community.

Risks and implications for the healthcare sector

This claim suggests that sensitive patient data within the healthcare sector may be at risk. Because healthcare providers handle highly personal information, they are frequent targets for cybercriminals. The potential exposure of patients' personal health information may lead to secondary risks, such as identity theft and targeted phishing attacks, where attackers use stolen details to deceive individuals.

Given the privacy laws and regulations concerning the protection of health information in Australia, this incident could lead to legal and administrative sanctions for the institution. The Safepay group appears to be employing a double-extortion strategy. This method involves not only encrypting a victim's systems to disrupt operations but also stealing sensitive data to threaten its public release. By threatening to publish exfiltrated data, the group increases the pressure on the organization to comply with ransom demands.

To defend against such threats, organizations in the healthcare sector typically focus on robust security frameworks. Common defensive steps include implementing strong access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized movement. Furthermore, staying compliant with regional privacy regulations and maintaining a rapid incident response plan are essential components of a modern cybersecurity posture for medical facilities.