Safepay ransomware group lists palmasdelixcan.com on its leak site

• Ransomware group: Safepay
• Country: Mexico
• Sector: Agriculture and Food Production
• Announcement date: July 16, 2025

Safepay claims a data breach against Palmas del Ixcan

The Safepay ransomware group has officially listed the entity associated with the domain palmasdelixcan.com on its dedicated leak site. According to the announcement made on July 16, 2025, the threat actors claim to have successfully exfiltrated a significant amount of data from the organization. This development follows an alleged attack date of June 1, 2025, marking a period of tension between the group and the target entity.

This listing is a characteristic move for modern ransomware operations that utilize double-extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption occurs. The threat of leaking this stolen data on a public platform serves as a powerful lever to pressure the victim into paying a ransom. By making the breach public, the group aims to maximize the reputational and operational damage to the target.

Details of the alleged data theft

Regarding the specifics of the breach, the Safepay group has provided limited information concerning the exact nature of the stolen files. The group claims to have obtained a total of 19.1 GB of data. While the volume of the data is specified, the group has not provided any specific details regarding the content or the exact types of files that were compromised.

The information currently available regarding the stolen data is as follows:

• The data is identified as a 19.1 GB ZIP file.

No further details regarding the specific contents of this archive have been disclosed by the threat actor at this time.

About Palmas del Ixcan

Palmas del Ixcan is a company based in Mexico that operates within the agriculture and food production sector. The organization focuses primarily on agricultural operations and the production of palm oil. As a player in the essential food production industry, the organization maintains various operational and commercial processes that are critical to its business model.

Analysis and potential risks

The Safepay group is considered an actor that emerged in late 2024. The group is known for employing double-extortion tactics to increase the pressure on their victims. The claim that the group does not operate an affiliate program suggests that these types of attacks may be directly coordinated by the core members of the group itself, rather than through a distributed network of partners.

The potential exposure of the organization's data poses several significant risks. The theft of information could lead to the exposure of trade secrets and sensitive operational information. Furthermore, because the organization is based in Mexico, the breach may lead to disruptions regarding compliance with local data protection regulations. If the claimed data is eventually published by the threat actors, secondary risks may arise, including the possibility of identity theft or the launch of targeted phishing attacks directed at the organization's employees and its various supply chain partners.

For organizations operating in the agriculture and food production sector, maintaining robust cybersecurity defenses is vital. Common defensive steps include implementing strict access controls, maintaining regular offline backups, and conducting regular security awareness training for employees to prevent initial access through phishing. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are also essential components of a comprehensive security posture to mitigate the impact of such incidents.