safepay ransomware group lists landwwilson.co.uk on its leak site

• Ransomware group: safepay
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: July 22, 2025

The ransomware group known as safepay has listed the United Kingdom-based organization landwwilson.co.uk on its leak site. The announcement, which appeared on July 22, 2025, indicates a significant data breach targeting the professional services sector. While the group has claimed responsibility for the incident, the details provided in the leak site announcement focus on the scale of the alleged theft and the financial profile of the victim.

Details of the claimed attack

According to the claims made by the safepay group, the attack against landwwilson.co.uk allegedly took place on June 2, 2025. The group has asserted that they have successfully exfiltrated a substantial amount of information from the target. In their announcement, the group specifically highlighted that the institution has an annual revenue of 15.9 million GBP, a detail often used by threat actors to gauge the potential for successful extortion.

By publishing the organization's information on a public leak site, the group is demonstrating the continued use of double-extortion tactics. In a double-extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. The threat of releasing this data publicly is used to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Data involved in the leak

Regarding the specifics of the stolen information, the group has not provided granular details regarding the exact content of the allegedly leaked data. The announcement only specifies the format and the size of the data package.

• The data is said to consist of a 165 GB ZIP file.

The listing does not name any specific data types or individual files contained within the archive.

Organization profile

Landw Wilson is a law firm based in the United Kingdom. The firm provides consultancy and legal services, with a particular focus on the fields of property law, commercial transactions, and private law.

Impact and industry implications

This incident may pose a significant risk to the institution's operational continuity and could potentially damage client trust. Because the organization is based in the United Kingdom, failure to comply with data protection obligations under the UK GDPR could lead to administrative sanctions. The exposure of sensitive information in the legal sector is particularly critical due to the nature of the data handled by such firms.

Depending on the actual content of the leaked data, the exposure of employee or client information may lead to identity theft and targeted phishing attacks. When personal or professional data is leaked, attackers often use it to craft highly convincing social engineering campaigns, making them more effective against the individuals whose information was compromised.

The use of double-extortion tactics by groups like safepay is intended to increase the pressure on an institution to pay a ransom. To mitigate such risks, organizations in the professional services sector often need to implement robust data breach notification processes and inform the affected parties. General defensive strategies for organizations facing such threats typically include maintaining rigorous backup protocols, implementing strict access controls, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration.