Safepay ransomware group lists rtblegal.com.au on its leak site

• Ransomware group: Safepay
• Country: Australia
• Sector: Professional Services
• Announcement date: May 26, 2025

Safepay claims data exfiltration from RTB Legal

The ransomware group known as Safepay has listed rtblegal.com.au on its leak site, claiming to have exfiltrated 200 GB of data. This announcement, which appeared on the group's platform, marks a potential significant breach for the targeted organization.

Details of the alleged attack

On May 26, 2025, the Safepay group published an announcement on its leak site targeting the domain rtblegal.com.au. According to the threat actor, the intrusion occurred around May 1, 2025. The group claims to have successfully obtained 200 GB of data from the organization's internal systems.

In addition to the claim regarding the volume of stolen information, the listing includes an estimate regarding the organization's annual revenue. While the group has made these claims, specific details regarding the exact nature of the alleged stolen data have not been provided; it is only stated that the data consists of a 200 GB archive file.

Organization profile

RTB Legal is a law firm based in Australia. It provides legal consulting and representation services, particularly in the fields of family law, property law, and commercial law.

Risk assessment and industry implications

This alleged data leak may pose a risk of exposing sensitive client information, given the organization's operation in the professional services sector. Ransomware groups frequently employ double extortion tactics, a method where attackers not only encrypt an organization's data but also steal it to use as leverage. This tactic suggests that there could be secondary risks, such as the publication or sale of the data on the dark web if demands are not met.

Under the Australian Privacy Act, such a data breach could lead to legal and regulatory consequences for the organization. Furthermore, it is possible that the leaked data could be utilized for identity theft or targeted phishing attacks against the firm or its clients. Public information regarding the Safepay group remains limited, making it difficult to determine their full scope of operations.

For organizations operating in the professional services sector, such incidents highlight the necessity of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing. As ransomware groups continue to target sensitive legal and consulting data, maintaining strict access controls and monitoring for unauthorized data exfiltration remains a critical priority for defensive teams.