Safepay ransomware group lists smilecenterutah.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Healthcare
• Announcement date: December 17, 2025

Safepay claims data theft from Smile Center Utah

The ransomware group known as Safepay has listed the Utah-based dental practice smilecenterutah.com on its dedicated leak site. According to an announcement published by the group on December 17, 2025, the threat actors claim to have successfully obtained data belonging to the institution. This development marks a potential security incident for the healthcare provider, although the specific details regarding the breach remain limited to the group's claims.

The announcement was made on the same day the group claims the attack occurred, which was December 17, 2025. At this stage, the threat group has not disclosed a specific ransom demand, nor have they provided information regarding the total size of the data or the specific number of files involved in the alleged theft. The lack of granular detail in the initial leak site posting is a common occurrence in the early stages of such incidents, where groups often use the threat of exposure to pressure victims.

Details regarding the alleged data breach

Regarding the content of the leaked information, there is currently no clear information regarding the specific data types involved in this incident. The listing provided by the group does not specify what categories of information were targeted or exfiltrated. Furthermore, the screenshot provided by the group in connection with this listing contains only general promotional information about the institution rather than evidence of sensitive records.

The listing names no specific data types that have been compromised.

The organization profile

Smile Center Utah is a private dental practice located in Provo, Utah. The institution provides comprehensive oral healthcare services to its patients within the community.

Risk assessment and industry implications

Given the double-extortion tactics frequently employed by the Safepay group, there is a significant risk that patient and employee data may be leaked. Double extortion is a method where attackers not only encrypt an organization's systems but also steal sensitive data, threatening to publish it on a leak site to increase pressure for ransom payments. This tactic shifts the focus from mere operational disruption to the potential exposure of confidential information.

As a healthcare entity, the institution may face data breach notification obligations under HIPAA regulations. Because healthcare providers handle sensitive personal health information, any confirmed breach of such data carries significant regulatory and legal implications. If the data is indeed leaked, secondary risks may occur, such as the misuse of personal health information or the potential for identity theft involving the affected individuals.

The Safepay group, which emerged in late 2024, is a relatively recent actor in the cyber threat landscape, and information regarding their specific methodologies and infrastructure remains limited. Consequently, their activities should be monitored closely by security professionals. Organizations operating in the healthcare sector often implement defensive measures such as robust encryption, strict access controls, and continuous monitoring to mitigate these types of risks. However, the evolving nature of ransomware groups like Safepay necessitates a proactive and vigilant approach to cybersecurity to protect sensitive patient and employee information from unauthorized disclosure.