safepay ransomware group lists ripobec.com on its leak site

• Ransomware group: safepay
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: March 3, 2026

The Canadian agricultural supply company ripobec.com has been listed on the leak site of the ransomware group known as safepay. The threat actor claims to have gained unauthorized access to the organization's network, marking a potential significant cybersecurity incident for the Quebec-based firm.

The claimed attack and extortion tactics

According to the announcement made by the safepay group on March 3, 2026, the threat actors claim to have obtained access to the network of ripobec.com on February 2, 2026. This timeline suggests that the attackers may have maintained presence within the infrastructure for approximately one month before the public listing occurred.

The group appears to be utilizing double extortion tactics in this instance. In a typical double extortion scenario, ransomware actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data to a remote server. The attackers then threaten to leak this stolen information on a public leak site if the ransom demands are not met. This method is designed to increase pressure on the victim organization by threatening their reputation and legal standing through the exposure of private data.

Details regarding the allegedly leaked data

At this stage of the incident, there is no screenshot or detailed information available regarding the content of the allegedly leaked data. The listing does not specify the volume of files involved or the total size of the data exfiltrated. Furthermore, no specific data types or categories have been identified in the announcement.

• The listing names no data types.

About ripobec.com

Ripobec is a family-owned agricultural supply company based in Saint-Apollinaire, Quebec. The company specializes in the production and distribution of premium wood products, serving the agricultural sector through its specialized supply chain.

Impact and industry considerations

This incident may create negative impacts on the organization's commercial operations and customer trust. Because the safepay group employs the double extortion method, the leaked data could lead to secondary risks such as identity theft or targeted phishing attacks. Additionally, similar risks may arise for the organization's supply chain partners, who may be targeted due to their business relationship with the affected company.

Under Canada's PIPEDA regulations, the organization may be required to fulfill data breach notification obligations. Organizations operating within the agricultural and food production sector often manage complex supply chains, making them potential targets for such attacks. To defend against these threats, organizations typically focus on robust network monitoring, strict access controls, and comprehensive employee training to mitigate the risk of initial access. Public information regarding the safepay group remains limited, making it difficult to determine their specific motivations or long-term patterns.