Safepay ransomware group lists studioelad.it on its leak site

• Ransomware group: Safepay
• Country: Italy
• Sector: Professional Services
• Announcement date: December 27, 2025

Safepay claims data breach at studioelad.it

The Safepay ransomware group has officially listed the Italian organization studioelad.it on its dedicated leak portal. According to the announcement made on December 27, 2025, the threat actor group claims to have successfully obtained the institution's data. Following this claim, the group has initiated a countdown timer on their site, a tactic frequently used to pressure victims into meeting specific demands before the stolen information is released to the public.

This specific type of announcement indicates that the Safepay group is employing a double-extortion strategy. In such cyberattacks, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The goal of double extortion is to hold both the ability to restore systems and the privacy of the data itself hostage, threatening to leak the information if the ransom is not paid.

Details regarding the claimed data

At this stage of the incident, the threat actor group has not provided any specific details regarding the nature of the leaked or threatened data. The announcement remains vague concerning the specific files or types of information that have been targeted during the intrusion.

• No specific data types have been identified in the current listing.

Organization profile

Studio Elad, which is legally registered as Elad S.r.l., is an Italian company. The firm operates within the professional services and consulting sector, providing specialized expertise to its client base.

Analysis and potential impact

The nature of the organization's operations in professional services and accounting suggests significant potential risks regarding the data involved. It is possible that the compromised data may include sensitive financial information belonging to clients. Such a breach could potentially increase the risk of identity theft and fraud for the institution's clients, as financial records are highly valued by malicious actors on the dark web.

Furthermore, because the entity is based in Italy, a potential data breach may lead to legal sanctions and notification obligations under the General Data Protection Regulation (GDPR). The regulatory framework governing data privacy in the European Union imposes strict requirements on organizations regarding how they handle and protect personal information, as well as how they report breaches to authorities and affected individuals.

The use of the double-extortion method by the Safepay group creates a multifaceted threat. If the stolen data is published, the institution could face significant reputational damage and severe disruption to its operational processes. For organizations operating in the professional services sector, maintaining client trust is paramount, and the public exposure of sensitive data can undermine that trust and lead to long-term consequences.

To defend against such threats, organizations typically focus on robust security postures. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are critical components of a modern cybersecurity strategy designed to mitigate the impact of ransomware and data theft.