Safepay ransomware group lists phillips66lubricants.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Energy & Utilities
• Announcement date: August 26, 2025

Safepay claims a data breach against Phillips 66 Lubricants

The threat actor known as Safepay has listed the domain phillips66lubricants.com on its leak platform, alleging that the organization has fallen victim to a cyberattack. This announcement, which appeared on the group's leak site on August 26, 2025, marks a new development in the group's activities targeting industrial entities.

Ransomware leak sites serve as a public stage for cybercriminals to exert pressure on their victims. By publishing the names of targeted organizations, these groups aim to increase the psychological and reputational pressure on a company to meet their demands. This tactic is a core component of modern cyber extortion campaigns.

Details of the alleged attack

According to the announcement made by Safepay, the group conducted a cyberattack against the organization, which they claim occurred around June 16, 2025. In their listing, the threat actors provided some financial context regarding the target, stating that the organization has an annual revenue of 20.4 million dollars.

The group's emergence in late 2024 suggests that their operational methods and tactics may still be evolving. As newer ransomware groups enter the threat landscape, security researchers often observe shifts in how they select targets and the specific pressures they apply during negotiations. The timing of this listing, several months after the claimed attack date, is a common occurrence in ransomware operations where groups may wait for a period before making a public announcement.

Information regarding the leaked data

Regarding the specific content of the alleged breach, the announcement does not provide details regarding the nature of the leaked data. The information provided by the group is limited to general business details, and the accompanying screenshot contains only general information about the organization's business activities.

The listing names no specific data types that have been compromised. Because no specific files or datasets were identified in the public announcement, the exact scope of the information at risk remains unconfirmed by the group's public post.

About Phillips 66 Lubricants

Phillips 66 Lubricants is a leading U.S.-based manufacturer and supplier of industrial and automotive lubricants. It operates as a subsidiary of the Phillips 66 company, playing a significant role in the supply of essential fluids for various industrial and automotive applications.

Analysis and industry implications

The use of double extortion tactics by the Safepay group suggests that the organization's sensitive data may be at risk of publication. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This approach is designed to ensure that even if a company can restore its systems from backups, they still face the threat of data exposure.

Given that the organization is based in the United States, a potential data breach could lead to legal proceedings under state-level privacy laws and sectoral regulations. If the leaked data were to include employee or customer information, such data could be utilized for identity theft or targeted phishing attacks. Such secondary attacks often follow a primary breach, as stolen credentials or personal details are highly valuable on illicit markets.

Furthermore, the organization's position in the energy sector could lead to indirect impacts on the supply chain if operational continuity is disrupted. For companies operating in critical sectors like energy and utilities, maintaining uptime is vital to prevent cascading effects throughout the industrial supply chain. To mitigate these risks, organizations typically focus on robust data encryption, strict access controls, and comprehensive monitoring to detect unauthorized movement of data before it can be exfiltrated.