Safepay ransomware group lists istitutocomprensivo-cavaglia.edu.it on its leak site

• Ransomware group: Safepay
• Country: Italy
• Sector: Education
• Announcement date: November 18, 2025

Safepay ransomware group claims attack on Italian school

The Italian educational institution istitutocomprensivo-cavaglia.edu.it has been listed on the leak site of the Safepay ransomware group. According to an announcement published on November 18, 2025, the group claims to have targeted the institution, marking a potential data breach incident involving the school.

The Safepay group published this announcement on their dedicated leak site on November 18, 2025. In their post, the group supported the listing by sharing general information regarding the institution's operations and student demographics. The group is known to employ a double-extortion strategy, a method where attackers not only encrypt an organization's data but also steal sensitive information to threaten its public release if a ransom is not paid.

Details regarding the claimed data breach

Despite the listing on the ransomware group's platform, the announcement remains vague regarding the specific contents of the alleged theft. The leak site announcement does not contain any specific details regarding data samples or the content of the compromised files. Furthermore, the group has not provided information regarding the total size of the data or the specific number of files involved in the incident.

The listing names no specific data types or categories of information that have been compromised.

About Istituto Comprensivo di Cavaglià

Istituto Comprensivo di Cavaglià is a public educational institution located in the Biella province of the Piedmont region, Italy. It provides primary and secondary education services to students within the region.

Risk assessment and implications for the education sector

Given that the institution operates in the education sector, the potential verification of these claims could pose significant risks to the privacy of student and staff data. Because the institution is based in Italy, any potential data breach may trigger legal proceedings under the General Data Protection Regulation (GDPR), which governs data privacy and protection within the European Union.

The double-extortion method used by the Safepay group may be intended to pressure the institution into paying a ransom. This situation could affect the institution's operational continuity and may create secondary risks such as identity theft or targeted phishing attacks. It is important to note that public information regarding this group is limited.

In general, ransomware attacks on educational institutions present unique challenges due to the high volume of sensitive personal information handled by these organizations. Organizations in this sector often face risks related to the privacy of students and staff, making the verification of such claims a critical matter for data protection authorities. To mitigate such risks, organizations typically focus on maintaining robust backup systems, implementing strict access controls, and conducting regular security awareness training to defend against the secondary risks of identity theft and phishing.