Safepay ransomware group lists termopuerto.com on its leak site

• Ransomware group: Safepay
• Country: El Salvador
• Sector: Transportation
• Announcement date: January 15, 2025

The threat group known as Safepay has announced the listing of termopuerto.com on their leak site. This announcement, made on January 15, 2025, indicates that the group claims to have gained access to the institution's data.

Details of the claim

On January 15, 2025, the Safepay group listed the domain termopuerto.com on their leak platform. According to the group's announcement, they have successfully breached the organization and claim to have obtained access to its internal data. However, the group has not provided specific details regarding the nature of the incident or the specific methods used to gain entry.

In many ransomware attacks, groups use leak sites to pressure victims into paying a ransom by threatening to release sensitive information. This tactic is a hallmark of modern cyber extortion. While the group has made this claim, the announcement remains limited in scope, as there is no detailed information regarding a ransom demand or the volume of the leaked data provided by the attackers.

Data involvement and verification

Regarding the content of the alleged breach, there is no information available regarding the nature of the leaked data. The provided screenshot associated with the claim does not contain sufficient information to verify the content or the authenticity of the data being discussed.

The listing names no specific data types that have been compromised.

Organization profile

Termopuerto is a logistics and terminal operator based at the port of Acajutla in El Salvador. The company provides port services, storage, and cargo handling solutions, making it a key player in the regional transportation and logistics infrastructure.

Risk assessment and industry implications

Given that the Safepay group is known to employ double extortion tactics, there may be a risk of the institution's data being published. Double extortion is a strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This increases the pressure on the victim to pay, as the threat of a data leak can lead to significant regulatory, legal, and reputational consequences.

If the claim is accurate, negative impacts on the institution's operational continuity and data privacy could be observed. Due to the nature of the sector, the exposure of logistics or operational data may trigger supply chain risks. In a globalized economy, disruptions or data leaks in transportation hubs can have cascading effects on the movement of goods and the security of connected partners.

Furthermore, in the following period, secondary risks such as identity theft for the institution's customers or employees may arise if personal information was indeed compromised. It is also worth noting that the fact that the group emerged in late 2024 may indicate that their operations are still in the early stages of development.

Organizations operating in the logistics and transportation sectors can mitigate such risks by implementing robust security frameworks. Common defensive steps include maintaining offline backups, enforcing multi-factor authentication across all access points, and conducting regular vulnerability assessments. Monitoring for unauthorized access and implementing strict network segmentation can also help prevent attackers from moving laterally through critical operational systems.