Safepay ransomware group lists Romanian technology company nod.ro on leak site

• Ransomware group: Safepay
• Country: Romania
• Sector: Technology
• Announcement date: July 12, 2025

Safepay claims data exfiltration from nod.ro

The Safepay ransomware group has listed the Romanian technology company nod.ro on its leak site. According to the announcement, the threat actors claim to have successfully exfiltrated a significant volume of data from the organization. This listing was made public on July 12, 2025, following an alleged attack that took place on May 29, 2025.

The incident highlights the ongoing risks faced by technology firms by specialized threat actors. Ransomware groups often use leak sites to pressure victims into paying ransoms by threatening to release sensitive information. This tactic, known as double extortion, involves both encrypting a victim's systems and stealing data to use as leverage during negotiations.

Details of the alleged breach

The Safepay group's announcement includes several specific claims regarding the scale and financial status of the target. The threat actor asserts that they have stolen 29.5 GB of data belonging to nod.ro. In addition to the data volume, the group included a claim regarding the company's financial standing, stating that the organization's annual revenue is 13.1 million dollars.

Regarding the specific nature of the information involved, the listing provides limited details. The available information is restricted to the following:

• Total data volume of 29.5 GB
• Claimed annual revenue of 13.1 million dollars

The listing does not provide specific information regarding the nature of the alleged leaked data. The provided screenshot only displays the total data volume and the figure claimed to be the company's financial revenue, leaving the exact content of the files unknown.

About nod.ro

NOD is a technology company based in Romania. The organization primarily operates in the fields of network solutions, IT infrastructure, and the supply of technological equipment. Given its role in providing critical IT and network services, the company operates within a sector that is often a high-value target for cybercriminals seeking to disrupt infrastructure or access sensitive client information.

Analysis and implications for the sector

Given the Safepay group's use of double-extortion tactics, it is assessed that the leaked data could impact the organization's operational continuity and commercial reputation. Because the organization is based in Romania, the breach may lead to regulatory consequences under the EU General Data Protection Regulation (GDPR).

While the content of the data remains unclear, the potential presence of employee or customer information could lead to secondary risks such as identity theft and targeted phishing attacks. The group emerged in late 2024, which suggests that its operational methods may still be evolving. This evolution indicates that organizations should enhance their proactive security measures to defend against emerging tactics.

For organizations operating in the technology and infrastructure sectors, maintaining robust security postures is essential. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent vulnerability assessments. As threat actors continue to refine their methods, proactive defense and rapid incident response capabilities remain critical for mitigating the impact of potential exfiltration events.