safepay ransomware group lists kenalex.ca on its leak site

• Ransomware group: safepay
• Country: Canada
• Sector: Professional Services
• Announcement date: December 19, 2025

The Canadian construction firm Kenalex Construction Co. Ltd. has been listed on the leak site of the ransomware group known as safepay. The group claims to have successfully targeted the organization and intends to use the stolen information to exert pressure through a double-extortion strategy.

The claimed attack and extortion method

On December 19, 2025, the safepay ransomware group published a listing for Kenalex Construction Co. Ltd. on their dedicated leak site. According to the group's announcement, they claim to have obtained the company's data. This publication suggests that a security breach affecting the organization's digital assets may have occurred, although the claim remains unconfirmed by the victim.

The group is employing a double-extortion tactic, a common method used by modern ransomware actors. In a double-extortion scenario, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat actors then threaten to leak this stolen information on public forums or dark web sites if the ransom is not paid. This method is designed to create significant financial and operational pressure on the organization, as the threat of a public data leak can lead to reputational damage, regulatory scrutiny, and legal liabilities.

The safepay group is a relatively recent emergence in the cyber threat landscape, having appeared in late 2024. Notably, the group does not appear to operate an affiliate program, which may indicate that the group manages its own operational processes and carries out its attacks independently.

Details regarding the alleged data breach

Regarding the specific nature of the information allegedly stolen from Kenalex Construction Co. Ltd., the group has not provided any specific details or file samples. At this time, no information has been provided regarding the volume of data, the specific file types, or the exact contents of the alleged leak.

• No specific data types or file samples have been provided.

About Kenalex Construction Co. Ltd.

Kenalex Construction Co. Ltd. is a construction and development firm based in Ontario, Canada. The company provides services to the Central and Northern regions of the country.

Implications and potential risks

Given the company's operations in the construction sector, the leaked data may potentially include employee information, commercial contracts, or project details. Because the organization is based in Canada, a potential data breach could fall under the scope of the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private-sector organizations handle personal information.

The use of double-extortion by safepay introduces several secondary risks. Beyond the immediate operational disruption, the leaked data could be utilized for identity theft or as a component in supply chain attacks, where the compromised organization is used as a stepping stone to reach their partners or clients. Such attacks can have cascading effects throughout an industry's ecosystem.

For organizations operating in the professional services and construction sectors, maintaining robust security postures is essential. Common defensive steps often include implementing multi-factor authentication (MFA), maintaining regular offline backups, and conducting regular security awareness training for employees. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations, such as PIPEDA, are critical components of a comprehensive cybersecurity strategy to mitigate the impact of potential breaches.