Safepay ransomware group lists kolpa.com.pe on leak site

• Ransomware group: Safepay
• Country: Peru
• Sector: Retail & E-Commerce
• Announcement date: May 6, 2025

Safepay claims data breach at kolpa.com.pe

The Safepay ransomware group has listed the organization kolpa.com.pe on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated a significant amount of data from the target. This development follows a pattern often seen in modern cyberattacks where threat actors use public platforms to pressure victims into meeting their demands.

The announcement was officially posted on the group's leak site on May 6, 2025. While the group has claimed the attack occurred as early as March 22, 2025, the public disclosure serves as a primary method for the group to signal its success to the victim and the wider cybersecurity community. This type of public shaming is a hallmark of contemporary ransomware operations.

Details of the claimed attack

The Safepay group has provided specific financial context regarding the target, claiming that kolpa.com.pe has an annual revenue of $19.8 million. By highlighting the organization's financial standing, the threat actors may be attempting to increase the pressure on the company through double extortion tactics. Double extortion is a strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information, threatening to leak it publicly unless a ransom is paid.

This tactic is designed to maximize leverage over the victim. Even if an organization has robust backups to restore its systems, the threat of a public data leak creates a secondary layer of crisis that targets the organization's reputation and legal standing. The group's involvement in such tactics suggests a sophisticated approach to extortion that moves beyond simple service disruption.

Data involved in the incident

Regarding the specific contents of the alleged breach, the group has not provided any details concerning the nature of the leaked information. The listing names no specific data types, only claiming the existence of a dataset. The following information has been provided by the threat actor:

• Claimed data size: 108 GB

The lack of specific information regarding the file types or the exact nature of the stolen data is common in the early stages of a leak site announcement, leaving the full scope of the potential exposure unknown to the public.

Impact and organizational implications

The use of double extortion by the Safepay group can have severe consequences for the operational continuity and reputation of the targeted organization. If the claimed data is indeed published, it could lead to significant risks for both the company and its stakeholders. Specifically, the exposure of sensitive information can facilitate identity theft or enable highly targeted phishing attacks against the organization's employees and its customer base.

For organizations operating within Peru, such incidents can present significant challenges regarding compliance with local data protection regulations. Ensuring that data privacy standards are maintained is a critical component of modern business operations, and a breach of this magnitude can trigger complex legal and regulatory scrutiny. Furthermore, as the Safepay group emerged in late 2024, their methods and tactics may still be evolving, which could lead to more complex and unpredictable attack patterns in the future.

In the retail and e-commerce sector, maintaining trust is paramount. Organizations in this space should consider implementing proactive defensive measures to mitigate the risks of such attacks. These measures typically include robust encryption for data at rest and in transit, strict access controls, and comprehensive employee training to recognize phishing attempts. Additionally, maintaining regular, offline backups and having a well-tested incident response plan are essential steps for ensuring resilience against ransomware and data exfiltration attempts.