Safepay ransomware group lists mylikowines.co.uk on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Retail & E-Commerce
• Announcement date: May 17, 2025

Safepay claims data breach at Myliko Wines

The ransomware group known as Safepay has listed the domain mylikowines.co.uk on its leak site, claiming to possess a significant amount of stolen information. According to the announcement published by the group, the threat actor claims to have obtained 7 GB of data belonging to the organization.

The announcement was made on May 17, 2025, although the group alleges that the actual attack took place earlier, on April 5, 2025. While the group has publicly identified the target, no specific details regarding the exact nature of the leaked information have been provided in the announcement.

Details of the group's claims

The Safepay group has made several claims regarding the impact of the alleged attack on the target organization. In addition to claiming the theft of 7 GB of data, the group alleges that the company generates $5 million in revenue. The publication of this data on a leak site is a common tactic used by cybercriminals to pressure victims into paying ransoms.

Ransomware leak sites serve as a public gallery for stolen data, used primarily for extortion. By listing a company's name and the volume of stolen data, these groups aim to damage the victim's reputation and create urgency. In this specific instance, the group's actions may potentially disrupt the company's operational activities.

Data involved in the incident

The listing names no specific data types that have been compromised.

About Myliko Wines

Myliko Wines is a UK-based wine and spirits retailer. The company operates in the online sale and distribution of a variety of wine and beverage products.

Analysis and potential implications

Given that the Safepay group employs a double-extortion strategy, there may be a risk that sensitive information, such as customer or employee records, could be exposed. Double extortion is a method where attackers not only encrypt a company's data to disrupt operations but also steal sensitive information, threatening to leak it publicly if the ransom is not paid. This approach increases the pressure on organizations due to the potential for regulatory and reputational damage.

As the company is based in the United Kingdom, any potential data breach may lead to legal consequences under the UK GDPR. Furthermore, considering the company's e-commerce operations, there may be a possibility of identity theft or targeted phishing attacks against customers. The fact that the group does not operate an affiliate program may suggest that attacks are coordinated directly by the group itself.

The potential public release of this data could negatively impact the company's commercial reputation. For organizations operating in the retail and e-commerce sectors, maintaining robust security postures is critical to protecting customer trust and ensuring compliance with data protection regulations. Common defensive measures often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to mitigate the risk of phishing and other common attack vectors.