Safepay ransomware group lists mercercapital.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Financial Services
• Announcement date: June 7, 2025

Safepay claims data breach at mercercapital.com

The Safepay ransomware group has listed mercercapital.com on their leak site, claiming to have obtained a significant amount of data from the organization. According to the announcement, the threat actor group has exfiltrated a large volume of information, which they intend to use as leverage against the target.

The listing, which appeared on the group's leak site on June 7, 2025, suggests a targeted operation. The group claims that the incident occurred on May 23, 2025, indicating that the breach may have been ongoing for a period before being publicized on their platform.

Details of the alleged exfiltration

While the specific nature of the leaked data has not been detailed by the threat actors, the group has provided some information regarding the volume and format of the stolen information. The listing indicates that the data is presented as a single ZIP file. The total size of the data claimed by the group is 289 GB.

The listing names no specific data types within the provided information.

The mechanics of double extortion

The circumstances surrounding this incident suggest the potential use of a double extortion scheme. In such scenarios, ransomware actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as a secondary tool for coercion. By threatening to publish the stolen information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent reputational damage or regulatory scrutiny.

About Mercer Capital

Mercer Capital is a financial advisory firm that provides a variety of professional services. The company specializes in business valuation, transaction advisory, and financial reporting. Additionally, the firm offers financial consulting and investment banking services to its clients.

Risk assessment and industry implications

This alleged data breach may pose significant risks to the institution's financial records and operational processes. Because the organization operates within the financial services sector, the integrity and confidentiality of its data are paramount to its core business functions.

As the institution is based in the United States, a potential breach could trigger notification obligations under relevant state laws and federal regulations. Organizations in the financial sector are subject to strict compliance standards regarding the protection of sensitive information, and any confirmed breach often necessitates formal reporting to regulatory bodies and affected parties.

The use of the double extortion method may lead to reputational damage and increase the risk of targeted phishing attacks against the institution's clients. When sensitive corporate or client data is leaked, attackers often use that information to craft highly convincing social engineering campaigns to further exploit the organization or its partners.

Regarding the threat actor, the Safepay group emerged in late 2024. Notably, the group operates without an affiliate program, which suggests that the group maintains its own operational discipline. This lack of an affiliate model often indicates a more centralized and controlled approach to their cybercriminal activities.

To mitigate such risks, organizations in the financial sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and conducting regular security assessments. Furthermore, maintaining a strong incident response plan is essential for managing the legal and reputational consequences of a potential data exfiltration event.