Safepay ransomware group lists proctorlane.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Education
• Announcement date: May 21, 2025

Safepay claims to have stolen data from Proctor Lane

The threat actor known as Safepay has listed the domain proctorlane.com on its leak site. This announcement, made on May 21, 2025, marks a new instance of targeted activity by the group. According to the claims made by the group, they have successfully exfiltrated a significant volume of information from the organization.

The group's announcement follows a pattern often seen in modern cyberattacks where the threat actor uses a dedicated leak site to pressure victims. These sites serve as a public platform to showcase the success of an intrusion and to host stolen information if negotiations fail. In this specific instance, the Safepay group has claimed to have acquired a data package totaling 120 GB.

Details of the claimed attack and data volume

The details provided by the Safepay group regarding the attack are limited. The group has claimed to have exfiltrated 120 GB of data from the organization. Notably, the group also mentioned the organization's revenue, stating it is 5 million dollars. However, the announcement did not include a specific ransom demand or a detailed description of the various types of data that may have been compromised.

Regarding the specific content of the breach, the listing provides no information regarding the nature of the leaked data. It is only stated that the acquisition consists of a 120 GB data package. No specific file counts or individual file types were provided in the group's communication.

About Proctor Lane

Proctor Lane is an educational technology company. The organization provides remote proctoring services, which are used for online exams and assessments to ensure integrity during the testing process.

Analysis and potential implications

The Safepay group is known to employ double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before encryption. The threat of leaking this stolen data on a public site is used as leverage to coerce the victim into paying a ransom. The publication of such data can lead to significant operational and reputational damage for an organization.

Because the entity is based in the United States, a confirmed breach could trigger legal processes under state-level data breach notification laws and relevant regulations. Furthermore, the situation may create long-term negative impacts on the organization's supply chain and customer trust. Secondary risks associated with such an event may include the use of leaked data in identity theft or targeted phishing campaigns.

It is worth noting that the Safepay group is reported not to use an affiliate program. This suggests that the attacks are likely coordinated directly by the group itself rather than through a network of independent contractors. For organizations in the education technology sector, maintaining robust security postures is critical to protecting student and institutional data. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent vulnerability assessments to mitigate the risk of unauthorized access and data exfiltration.