Safepay ransomware group lists teccart.qc.ca on its leak site

• Ransomware group: Safepay
• Country: Canada
• Sector: Education
• Announcement date: December 14, 2025

Safepay claims ransomware attack against Teccart

The Canadian educational institution Teccart (teccart.qc.ca) has been listed on the leak site of the Safepay ransomware group. According to the announcement made by the group, the institution was targeted in a ransomware attack that allegedly occurred on November 29, 2025. The listing was officially posted on the group's leak site on December 14, 2025.

The Safepay group alleges that they have successfully exfiltrated data from the institution. In their announcement, the group claims to have employed a double-extortion tactic. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information beforehand. The threat actors then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid, thereby increasing the pressure on the victim through the threat of reputational damage and regulatory scrutiny.

Details regarding the alleged data breach

While the Safepay group has claimed responsibility for the incident and the exfiltration of information, the provided records do not specify the exact nature of the data involved. There is no specific information regarding the nature of the allegedly exfiltrated data in the provided record or screenshot. Furthermore, the announcement does not provide details regarding the total size of the data or the specific number of files that were purportedly taken during the attack.

Affected data types

• The listing names no specific data types.

About Teccart

Teccart is an educational institution based in Montreal, Canada. Founded in 1945, the organization provides practical, career-focused training across several disciplines, including technology, design, business, management, and the arts.

Risk assessment and implications

The alleged attack may pose a significant risk of exposure for student and staff data. Given the institution's role in the education sector, there is a potential risk that sensitive financial and academic records may be at risk. Such a breach could trigger legal processes regarding the protection of personal information under Canada's PIPEDA regulations.

The use of the double-extortion tactic by the Safepay group may increase pressure on the institution and heighten secondary risks. These secondary risks include the potential for identity theft and the occurrence of targeted phishing attacks against the institution's members. Because the Safepay group emerged in late 2024, their operational capacity and motivation should be closely monitored by security professionals.

For organizations in the education sector, such incidents highlight the importance of robust data protection frameworks. Common defensive steps for organizations facing these threats often include maintaining offline backups, implementing strict access controls, and conducting regular security awareness training to mitigate the risk of initial entry. Monitoring for unauthorized data exfiltration and ensuring compliance with regional privacy regulations are also critical components of a modern cybersecurity posture.