safepay ransomware group lists usdaw.org.uk on its leak site

• Ransomware group: safepay
• Country: United Kingdom
• Sector: Government & Defense
• Announcement date: December 29, 2025

The listing of Usdaw by safepay

The United Kingdom-based trade union Usdaw has been listed on the leak site of the ransomware group safepay. According to an announcement made on December 29, 2025, the group has made claims against the organization, alleging that they have successfully gained access to the institution's data.

This public listing is a common tactic used by cybercriminal groups to increase pressure on their targets. By publishing the name of an organization on a dedicated leak site, the threat actors aim to create visibility and urgency, often as part of a broader extortion strategy designed to force the victim into meeting specific demands.

Details of the claimed attack

The safepay group listed the domain usdaw.org.uk on its leak site on December 29, 2025. In their announcement, the group alleges that they have obtained access to the organization's internal data. This claim was publicized by the group as a means of asserting their successful intrusion into the network.

This specific type of announcement is often interpreted as an attempt by the group to exert pressure on the organization using double-extortion tactics. In a double-extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The threat of leaking this stolen data publicly serves as a secondary lever to coerce the organization into paying a ransom.

Regarding the specifics of the breach, no details or sample files regarding the content of the allegedly leaked data have been provided by the group. The listing does not specify the volume of data involved or the specific types of files that were targeted during the incident.

About Usdaw

Usdaw (Union of Shop, Distributive and Allied Workers) is a major trade union based in the United Kingdom. The organization represents workers within the retail and distribution sectors. Its primary mission is to operate in a manner that protects the working conditions, rights, and wages of its members.

Risk assessment and implications

This incident may present a risk of exposing personal data belonging to union members. Because the organization operates within the United Kingdom, a potential data breach could trigger legal processes under the UK GDPR. Organizations operating under these regulations must adhere to strict protocols regarding the protection of personal information and the notification of authorities and affected individuals in the event of a compromise.

The possibility of members being exposed to identity theft or targeted phishing attacks should be considered following such a claim. When personal information is compromised, individuals often become targets for subsequent social engineering campaigns where attackers use stolen details to appear legitimate.

The double-extortion method employed by the safepay group may create additional pressure on the organization through the threat of data publication. Information regarding the safepay group remains limited; the group is said to have emerged in late 2024 and does not utilize an affiliate program.

For organizations in the government and defense or labor sectors, maintaining robust defensive postures is essential. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access early. Addressing the risks of identity theft and phishing requires ongoing awareness training for members and employees to recognize the signs of targeted social engineering attacks.