Safepay ransomware group lists ryomo.co.jp on its leak site

• Ransomware group: Safepay
• Country: Japan
• Announcement date: September 15, 2026

The Safepay ransomware group has listed the Japan-based systems integrator ryomo.co.jp on its leak site. This announcement, made on September 15, 2026, indicates that the threat actor claims to have conducted a ransomware attack against the organization.

The alleged attack by Safepay

The threat actor known as Safepay claims to have carried out a ransomware attack against ryomo.co.jp. According to the announcement posted on the group's leak site on September 15, 2026, the group alleges that it has compromised the organization's data. The group has issued threats to publish the compromised information.

The announcement includes general information regarding the operations of the company, but the group has not provided specific details regarding the volume of the compromised data. Furthermore, no details regarding the nature of the compromised or threatened data have been provided in the announcement. The listing does not specify the amount of files involved or the specific ransom demand requested by the attackers.

Data involved in the claim

The listing names no specific data types that have been compromised or are being threatened for publication.

Organization profile

Ryomo Systems Co., Ltd. is a Japan-based systems integrator that was established in 1970. The company provides a variety of services, including enterprise software solutions, cloud services, and IT infrastructure management.

Potential impact and assessment

This alleged attack by the Safepay group may lead to disruptions in the organization's operational processes. Given the group's use of double extortion tactics, the threat to publish sensitive data could result in secondary risks such as the exposure of customer and employee information. In double extortion schemes, attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to pressure the victim into paying a ransom.

The organization may face legal obligations under Japanese data protection regulations following such an incident. Furthermore, as a systems integrator, the potential impact on the organization's supply chain could pose indirect risks to its clients. Because the organization manages IT infrastructure and software solutions for others, a compromise in their environment can have ripple effects throughout their client base.

Public information regarding the Safepay group is limited. In general, organizations facing such threats often focus on strengthening their defensive postures through various security measures. These typically include maintaining robust backup strategies, implementing multi-factor authentication, and ensuring continuous monitoring of network environments to detect unauthorized access or unusual data movement early in the attack lifecycle.