Safepay ransomware group lists servicecentermetals.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Manufacturing
• Announcement date: May 26, 2025

The Safepay ransomware group has listed servicecentermetals.com on its leak site, claiming to have exfiltrated a significant volume of data from the organization. According to an announcement made by the threat actor, the breach involves a large data package allegedly stolen from the company's internal systems.

The claimed attack and event details

The threat actor known as Safepay announced in a post dated May 26, 2025, that they have targeted servicecentermetals.com. This announcement follows an alleged attack date of April 22, 2025. The group claims to have successfully exfiltrated 120 GB of data, which they assert was obtained directly from the organization's systems.

Ransomware attacks of this nature often involve a process where attackers gain unauthorized access to a network, move laterally to locate sensitive information, and then extract that data before deploying encryption. Once the data is stolen, the attackers typically use a leak site to pressure the victim into paying a ransom by threatening to release the information publicly. This specific incident, as reported by the group, suggests that the organization's operational processes may be under threat due to the potential publication of this data.

Details regarding the leaked data

Regarding the specifics of the information allegedly stolen, the group has provided limited information. The listing specifies the volume of the stolen information but does not provide a breakdown of the specific files or categories of data involved. The listing names no specific data types or contents.

The available information is limited to the following:

• Claimed data size: 120 GB

There is no specific detail regarding the content of the leaked data in the records; it is only stated that it is a 120 GB data package. No specific details were provided regarding the exact file count or the nature of the documents contained within the package.

About servicecentermetals.com

Service Center Metals is an American company that provides aluminum extrusion products and related metal solutions. It specializes in the manufacturing and distribution of aluminum profiles for construction, automotive, and industrial applications.

Risk assessment and industry implications

This leak, allegedly carried out by the Safepay group, indicates that the organization may face the risk of exposure of its commercial and operational data. As a US-based entity, potential data breaches may be subject to state-level privacy laws and federal regulations. The scale of the alleged exfiltration suggests that the breach could have significant implications for the company's business operations.

Given the group's known double-extortion tactics, it is foreseeable that the leaked data could be utilized for secondary attacks, identity theft, or targeted phishing campaigns. In double-extortion scenarios, the attackers do not just encrypt the victim's files to disrupt operations; they also steal sensitive data to use as leverage, threatening to leak it if the ransom is not paid. This adds a layer of complexity to incident response, as even if systems are restored from backups, the threat of data exposure remains.

Furthermore, it is assessed that this incident may also pose an indirect risk to the organization's supply chain partners. In the manufacturing sector, companies are often deeply integrated with their clients and suppliers. A breach in one company can potentially expose the business relationships, technical specifications, or logistical details of its partners. Organizations in this sector can take defensive steps such as implementing strict network segmentation, maintaining robust offline backups, and enforcing multi-factor authentication to mitigate these risks.