Safepay ransomware group lists palmettoeyeinstitute.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Healthcare
• Announcement date: September 8, 2026

Safepay claims a data breach at Palmetto Eye Institute

The Safepay ransomware group has listed the US-based Palmetto Eye Institute on its leak site, alleging a data breach. According to the announcement, the threat actor group claims to have compromised data belonging to the medical institution. This development follows the group's established pattern of targeting organizations to exert pressure through the threat of data publication.

The announcement was published on September 8, 2026, with the group claiming the attack occurred on the same day. Safepay is identified as a double-extortion actor that emerged in late 2024. In such attacks, threat actors typically steal sensitive information before encrypting systems, using the threat of leaking that data to demand payment. This tactic is designed to increase pressure on the victim by threatening the public release of their private information.

Details regarding the claimed compromise

Regarding the specifics of the breach, the announcement does not provide specific details regarding the nature of the compromised data. While the listing does not explicitly name the types of files or information stolen, the inclusion of healthcare-related information remains a possibility given the nature of the targeted organization.

The listing names no specific data types.

About Palmetto Eye Institute

Palmetto Eye Institute is an eye care center founded by Dr. Prat Itharat, specializing in cataract surgery and comprehensive eye care. It is located in Columbia, South Carolina.

Analysis and potential impact

Given the institution's presence in the healthcare sector, the compromised data may include sensitive patient information subject to HIPAA regulations. This could potentially lead to identity theft and fraud risks for affected individuals. Furthermore, the organization may face operational disruptions and significant reputational damage as a result of the incident.

The double-extortion tactics employed by Safepay are intended to increase pressure on the victim through the threat of data publication. It is also possible that the leaked data could be utilized in future targeted phishing campaigns. Such campaigns often leverage stolen information to trick employees or patients into revealing further credentials or sensitive details.

In the healthcare sector, organizations often face significant risks when dealing with sensitive patient data. To defend against such threats, organizations typically implement various security measures. These can include robust encryption for data at rest and in transit, multi-factor authentication to secure access to clinical systems, and continuous monitoring of network traffic to detect unauthorized access. Additionally, regular security awareness training for staff can help mitigate the risk of phishing, which is a common entry point for ransomware groups.