Safepay ransomware group lists olympusaero.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Manufacturing
• Announcement date: May 15, 2025

Safepay claims data breach at Olympus Aero

The ransomware group known as Safepay has officially listed the manufacturing firm olympusaero.com on its leak site. According to the announcement made on May 15, 2025, the threat actors claim to have successfully breached the organization's systems and exfiltrated a significant volume of data.

Ransomware attacks often involve a process where attackers gain unauthorized access to a network to encrypt files or steal sensitive information. When a group utilizes a leak site, it is often part of a broader strategy to pressure the victim into paying a ransom by threatening to release the stolen information to the public.

Details of the claimed attack

The Safepay group claims that the initial access to the organization's systems occurred on April 12, 2025. In their announcement, the group highlighted the financial scale of the target, noting that the organization has an annual revenue of $13 million. This information is frequently used by ransomware groups to gauge the potential payout during negotiations.

The group's announcement is categorized as a data leak notification. While the group has claimed responsibility for the breach, the specific details regarding the contents of the stolen information remain limited. The group has provided no specific details regarding the content of the leaked data, other than it being a 130 GB ZIP file.

Data characteristics

• Total claimed data size: 130 GB
• File format: ZIP

The listing names no specific data types or individual files within the claimed archive.

About Olympus Aero

Olympus Aero is a manufacturing company that produces precision-machined parts and components for the aerospace industry. Based in Texas, the firm provides high-quality engineering solutions for aircraft engines and structural components.

Analysis and potential impact

Given the Safepay group's double-extortion tactics, it is assessed that the leaked data could potentially harm the organization's intellectual property and operational processes. Double extortion is a common ransomware tactic where attackers not only encrypt a company's data but also steal it, threatening to leak it to damage the company's reputation or force payment through the fear of public exposure.

Because the organization is based in the United States, the potential data breach may trigger legal processes under state-level privacy laws and sectoral regulations. Furthermore, the publication of this data could create secondary risks for employees and business partners, such as identity theft or targeted phishing attacks. Such attacks often follow a breach, as stolen information can be used to craft highly convincing fraudulent communications.

The nature of the threat actor also presents unique considerations. The Safepay group emerged in late 2024 and does not utilize an affiliate program, which may suggest that attacks are conducted under centralized control. This centralized operational structure can make the group's activities more predictable but also highly focused. Additionally, for companies in the aerospace and manufacturing sectors, such incidents can lead to concerns regarding the organization's supply chain security, as a breach in one manufacturer can potentially impact the broader network of partners and clients.

In general, organizations facing such threats often prioritize incident response, forensic investigation, and strengthening network segmentation to prevent lateral movement by attackers. Maintaining robust backup strategies and implementing strict access controls are also standard defensive measures used to mitigate the impact of unauthorized access.