safepay ransomware group lists vitatrac.com.gt on its leak site

• Ransomware group: safepay
• Country: Guatemala
• Sector: Retail & E-Commerce
• Announcement date: December 24, 2025

The safepay ransomware group has officially listed the Guatemalan company Vitatrac S.A. on its dedicated leak site. According to an announcement published by the threat actor, the group claims to have successfully gained access to the organization's digital assets. This development marks a new instance of targeted activity by the group against a major regional service provider.

The claims made by safepay

On December 24, 2025, the threat actor known as safepay published an announcement on its leak site, identifying Vitatrac S.A. as a victim of their operations. The group's post included a summary of the company's business operations and its service portfolio, which is a common tactic used by such groups to confirm the legitimacy of their target to other interested parties.

The timing of the announcement coincides with the claimed attack date of December 24, 2025. While the group asserts they have breached the organization's digital environment, the specific methods used to gain this access have not been detailed in the public post. Ransomware leak sites serve as a platform for these groups to exert pressure on victims by threatening to release sensitive information if demands are not met.

Information regarding the compromised data

Despite the claim of unauthorized access to digital assets, the group has not provided specific details regarding the nature of the allegedly compromised data. No information has been provided concerning the specific types of files or the volume of information that may have been exfiltrated during the incident.

• No specific data types have been identified in the listing.

The lack of information regarding the specific contents of the breach is a notable aspect of this particular announcement. Without further details from the threat actor, the exact scope of the data exposure remains unconfirmed.

About Vitatrac S.A.

Vitatrac S.A. is a well-established company based in Guatemala. The organization specializes in automotive services and tire distribution. It maintains a significant presence in the region, operating through numerous service centers located across the country to support its diverse customer base.

Analysis and potential implications

The safepay group is characterized as a double-extortion ransomware entity that emerged in late 2024. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on public forums, attackers increase the pressure on the victim to pay the ransom to prevent reputational damage or regulatory scrutiny.

The potential exposure of the organization's data could lead to secondary risks, such as the disclosure of customer and employee information. Such a breach could potentially be utilized by malicious actors for identity theft or targeted phishing campaigns against the individuals involved. Furthermore, the company may face legal obligations under data protection regulations in Guatemala following such an incident.

For organizations operating in the retail and e-commerce sectors, or those providing essential services like automotive maintenance, maintaining robust cybersecurity postures is critical. Common defensive steps for organizations to mitigate these risks include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees. As public information regarding the safepay group remains limited, organizations are advised to remain vigilant against the evolving tactics used by such entities.