safepay ransomware group lists millerservicecompany.com on its leak site

• Ransomware group: safepay
• Country: United States
• Sector: Professional Services
• Announcement date: November 19, 2024

The entity associated with the domain millerservicecompany.com has been listed on the leak site of the ransomware group known as safepay. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack that resulted in a significant data leak.

The claimed attack event

The safepay group listed data allegedly belonging to millerservicecompany.com on their leak site on November 19, 2024. The threat actor claims that the attack occurred on October 25, 2024. This timeline suggests a period of several weeks between the initial claimed intrusion and the public listing of the victim on the group's platform.

Ransomware leak sites are specialized platforms used by cybercriminal groups to exert pressure on victims. These sites typically host stolen data to shame organizations into paying ransoms. In many cases, these groups employ double extortion tactics. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive information to threaten its public release. By threatening to publish stolen data, attackers increase their leverage during negotiations, as the threat of a data leak can cause significant reputational and legal damage.

Details of the alleged data leak

Regarding the contents of the breach, the safepay group claims that the total volume of the data involved is 70 GB. However, the specific nature of the leaked data remains unknown, as no details regarding the types of files or the specific categories of information have been provided by the attackers. Furthermore, no screenshot has been made available to verify the contents of the alleged leak.

• The listing names no specific data types.

When investigating such incidents, the absence of verifiable evidence, such as file samples or screenshots, is a common occurrence in the early stages of a leak site announcement. This lack of information makes it difficult for security researchers to immediately determine the exact scope of the sensitive information that may have been compromised.

About Miller Service Company

Miller Service Company is an HVAC (heating, ventilation, and air conditioning) services company based in Kentucky. It provides heating, cooling, and plumbing solutions to residential and commercial customers.

Risk assessment and implications

This incident may pose a risk to the institution's operational continuity and data privacy. Given that the safepay group is known to employ double extortion tactics, the leaked data could potentially be used in secondary attacks or identity theft attempts. As the entity is based in the US, legal processes under state-level data breach notification laws and relevant regulations may be triggered. Furthermore, the institution's customers and employees could be exposed to targeted phishing attacks.

The fact that the group emerged in 2024 suggests that their attack patterns may not yet be fully analyzed, and the risk remains uncertain. For organizations operating in the professional services sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations facing these threats include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining a clear incident response plan is essential for managing the legal and operational fallout of a potential data breach.