Safepay ransomware group lists morricetransportation.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Transportation
• Announcement date: May 11, 2025

Safepay claims data exfiltration from Morrice Transportation

The Safepay ransomware group has officially listed morricetransportation.com on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated a significant amount of data from the organization's systems. This development marks a new instance of the group targeting entities within the transportation and logistics sector.

The announcement was published on the group's leak portal on May 11, 2025. While the group has claimed the attack occurred around April 4, 2025, the listing serves as a public notification of their alleged success. The Safepay group is recognized in the threat intelligence community for employing double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak sensitive information to pressure the victim into paying a ransom.

Details regarding the alleged data breach

Regarding the specifics of the incident, the group has provided limited information concerning the exact nature of the files they claim to have stolen. While the announcement confirms a breach has occurred, the specific types of documents or sensitive information contained within the stolen files remain unknown. The only visual evidence provided by the group is a screenshot indicating the presence of a single ZIP file with a total size of 40 GB.

The listing does not specify the following details:

• The specific nature of the leaked data
• The exact file count
• The specific ransom demand amount

Because the group has not disclosed the contents of the 40 GB ZIP file, the true impact on the organization's data privacy remains unclear at this time.

About Morrice Transportation

Morrice Transportation is a logistics and freight services company based in the United States. The organization operates within the field of road transportation and freight shipping, providing essential services for the movement of goods across the country. As a logistics provider, the company's operations are deeply integrated into the supply chain, making the security of their digital infrastructure vital for operational continuity.

Analysis and potential implications

The use of double extortion tactics by the Safepay group significantly increases the risk profile for the targeted organization. Even if an organization can recover its systems through backups, the threat of leaking or selling sensitive data remains a potent weapon for the attackers. This tactic shifts the focus from mere operational disruption to long-term reputational and legal damage.

Since Morrice Transportation is based in the United States, any confirmed data breach may trigger complex legal obligations. The organization may be subject to various state-level data protection laws and specific sectoral regulations designed to protect sensitive information. Furthermore, the breach presents secondary risks to both the organization and its stakeholders. Employees and customers may face increased vulnerability to identity theft or highly targeted phishing attacks if their personal information is included in the leaked data.

It is also worth noting that the Safepay group emerged in late 2024. This relatively recent appearance suggests that their operational methods, tactics, and procedures may still be evolving, making them a dynamic threat to various industries. For organizations in the transportation and logistics sector, maintaining robust cybersecurity posture is essential to mitigate the negative impacts on operational continuity and brand reputation that such attacks can cause.

General defensive considerations

In the face of such threats, organizations typically focus on several defensive pillars. Implementing strong access controls and multi-factor authentication can help prevent unauthorized entry. Regular, offline backups are critical for recovering from encryption-based attacks, while data loss prevention tools can help monitor and restrict the movement of sensitive information out of the network. Finally, continuous monitoring and incident response planning are vital to minimize the impact of a successful exfiltration event.