Safepay ransomware group lists knightgroup.co.uk on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: December 29, 2025

Safepay ransomware group targets Knight Group

The Safepay ransomware group has listed the United Kingdom-based metal processing company Knight Group on its dedicated leak site. According to an announcement published by the threat actor, the organization has been targeted in a cyberattack involving data exfiltration.

The claim was made on December 29, 2025. The threat actor alleges that it has successfully compromised the company's systems and has exfiltrated data as part of a targeted operation. This type of announcement is a common tactic used by ransomware groups to pressure victims into meeting their demands by threatening the public release of sensitive information.

The details of the alleged breach

The threat actor known as Safepay published a notice claiming that data belonging to Knight Group has been compromised. The group alleges that it has utilized a double-extortion strategy to conduct this attack. In a double-extortion scenario, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive data before encryption. This allows them to threaten the victim with the public disclosure of that data if a ransom is not paid, creating a secondary layer of leverage.

While the notice contains general information regarding the company's operations, the announcement provides no specific evidence regarding the actual scope of the data breach. The listing does not specify the volume of data taken or the specific files that were accessed. Furthermore, the nature of the compromised or threatened data is not specified in the announcement.

• No specific data types were named in the listing.

About Knight Group

Knight Group is a UK-based precision metal stockist and processor with a long-standing history dating back to 1943. The company specializes in the supply and processing of metal products for various industries. Due to its specialized nature, the company serves as a vital component in the supply chains of several high-stakes industrial sectors.

Risk assessment and implications

The use of double-extortion by the Safepay group suggests that the company's sensitive commercial and operational data may be at risk of public exposure. As a United Kingdom-based entity, a potential data breach could trigger legal processes and regulatory penalties under the UK GDPR framework. Such regulations are designed to ensure that organizations protect personal and sensitive data, and failures in protection can lead to significant oversight and fines.

Given that the company supplies critical sectors such as aerospace and automotive, the incident may pose secondary risks to supply chain security. When a supplier in a critical industrial chain is compromised, it can create ripple effects that impact the security and continuity of the entire supply chain. Additionally, there is a possibility that any exfiltrated data could be utilized by malicious actors for identity theft or targeted phishing campaigns against the company or its partners.

The Safepay group, which emerged in late 2024, remains a relatively new entity in the threat landscape, and public information regarding their specific tactics, techniques, and procedures remains limited. Organizations in the manufacturing and processing sectors often face these types of threats and typically focus on defensive measures such as robust data encryption, strict access controls, and comprehensive monitoring to mitigate the risks of exfiltration and extortion.