Safepay ransomware group lists nhpsa.com.ar on its leak site

• Ransomware group: Safepay
• Country: Argentina
• Sector: Manufacturing
• Announcement date: December 24, 2025

Safepay claims ransomware attack against New High Pack S.A.

The Safepay ransomware group has officially listed New High Pack S.A. (NHPSA) on its dedicated leak site. According to the announcement made on December 24, 2025, the threat actor group claims to have conducted a ransomware attack against the organization on the same day the listing appeared.

The group published the announcement by including general information regarding the company's operations. This specific type of listing, where an organization is named alongside its operational details, is a common tactic used by modern ransomware groups. Such actions are often intended to exert pressure on the victim organization to fulfill ransom demands by threatening the public release of sensitive information.

The nature of the claimed data breach

Regarding the specific content of the alleged breach, the announcement on the leak site does not provide any specific information or sample files regarding the nature or content of the data allegedly exfiltrated. The listing does not specify the volume of data stolen or the number of files involved, nor has a specific ransom demand been made public in the announcement.

The listing names no specific data types or categories of information that have been compromised.

Organization profile: New High Pack S.A.

New High Pack S.A. (NHPSA) is an Argentine packaging manufacturer and supplier. The company operates in Benavídez, Tigre, within Argentina.

Analysis and potential impact of the attack

The use of a leak site in this manner suggests that the Safepay group may be employing a double-extortion strategy. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before encryption. The threat of leaking this data serves as a secondary lever to coerce the victim into paying the ransom, even if the organization has robust backups to restore its systems.

The employment of this method suggests that the organization may face the risk of having sensitive data published. This could potentially lead to the disclosure of the company's trade secrets and operational data. Furthermore, if the leaked data includes employee or customer information, these individuals may be exposed to identity theft or targeted phishing attacks.

From a regulatory perspective, under Argentine data protection regulations, the organization may be required to fulfill data breach notification obligations. Organizations facing such threats often prioritize incident response protocols to mitigate the impact of potential data exposure and to comply with regional legal requirements.

The Safepay group, which emerged in late 2024, appears to be in an evolving phase of its operations. Given its recent emergence, it is possible that the group's tactics and targets are still developing, and they may target other organizations in similar sectors in the future.

General defensive considerations for the manufacturing sector

While specific details regarding this incident remain limited, manufacturing organizations often face unique risks due to their complex supply chains and integration of operational technology. To defend against ransomware and double-extortion tactics, organizations typically focus on several key areas:

• Data Loss Prevention (DLP): Implementing tools to monitor and prevent the unauthorized transfer of sensitive information outside the network.
• Network Segmentation: Dividing networks into smaller segments to prevent attackers from moving laterally from office environments to production environments.
• Robust Backup Strategies: Maintaining offline or immutable backups to ensure data can be restored without paying a ransom.
• Employee Awareness Training: Educating staff to recognize phishing attempts, which are a common entry point for ransomware actors.