Safepay ransomware group lists redsquaredentalcare.com on its leak site

• Ransomware group: Safepay
• Country: United Kingdom
• Sector: Healthcare
• Announcement date: May 17, 2025

Safepay claims data breach at Red Square Dental Care

The ransomware group known as Safepay has listed redsquaredentalcare.com on its official leak site. According to the group's announcement, they claim to have successfully breached the systems of the organization and acquired a significant amount of data. This listing, which appeared on May 17, 2025, suggests that the digital assets of the organization may have been compromised by these threat actors.

Details of the alleged attack

The claims made by the Safepay group indicate that the intrusion occurred prior to the public announcement. While the exact timeline of the initial access remains unconfirmed, the group alleges that they gained access to the organization's systems and subsequently extracted a large volume of information. The announcement serves as a public notification on the group's platform, a common tactic used by ransomware operators to pressure victims.

Ransomware leak sites function as a public gallery for stolen data. These platforms are utilized by threat actors to showcase their successes and to exert psychological pressure on victims through the threat of public exposure. By listing a target on such a site, the group aims to damage the reputation of the victim and increase the likelihood of receiving a ransom payment.

Data involved in the incident

Based on the information provided by the group, the volume of the data involved in this incident is substantial. The group's claims include the following details:

• The total size of the claimed data is 18 GB.

While the group has specified the total size of the data, they have not provided any specific details regarding the nature or the specific types of the content contained within the files. No specific file counts or details regarding the exact content of the 18 GB have been disclosed in the announcement.

About Red Square Dental Care

Red Square Dental Care is a dental clinic based in the United Kingdom. The organization provides a range of oral health services, including general dentistry, to its patient base in the UK.

Potential impact and sector considerations

This incident carries significant implications due to the nature of the organization's operations. Because the organization operates within the healthcare sector, this breach may pose serious risks to the confidentiality of sensitive patient information. In the healthcare industry, the protection of patient data is paramount, as such information is highly sensitive and highly valued by malicious actors.

Furthermore, as the organization is based in the United Kingdom, a confirmed data breach could lead to significant legal repercussions under the UK GDPR (General Data Protection Regulation). This regulatory framework imposes strict requirements on how organizations handle personal data and mandates specific protocols in the event of a breach.

The Safepay group appears to employ a double-extortion strategy. In a double-extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal the data before encryption. This allows them to threaten the victim with the public release of sensitive information if the ransom is not paid. This method increases the pressure on the victim, as the threat of data exposure can be more damaging than the operational downtime caused by encryption alone. The leaked data could potentially be utilized for identity theft or for conducting highly targeted phishing attacks against the organization or its clients.

Given these risks, organizations in the healthcare sector must remain vigilant. Common defensive steps for such organizations include implementing robust encryption for data at rest and in transit, maintaining strict access controls, and conducting regular security audits. Furthermore, continuous monitoring of network traffic and maintaining comprehensive incident response plans are essential components of a modern cybersecurity posture to mitigate the impact of such threats.