Safepay ransomware group lists zanettisrl.it on its leak site

• Ransomware group: Safepay
• Country: Italy
• Sector: Manufacturing
• Announcement date: August 29, 2025

Safepay ransomware group claims attack on Zanetti S.r.l.

The Safepay ransomware group has officially listed the Italian organization Zanetti S.r.l. on its dedicated leak site. In an announcement published on August 29, 2025, the threat actor group claimed to have successfully compromised the data belonging to the institution. This development marks a new instance of targeted activity by the Safepay group against a specialized manufacturing entity.

Ransomware leak sites are platforms used by cybercriminal groups to exert pressure on victims. These sites often host announcements regarding new targets, sometimes including proof of the breach to validate their claims. By listing an organization, these groups aim to damage the victim's reputation and coerce them into paying a ransom to prevent the public release of sensitive information.

Details of the claimed incident

According to the announcement made by the Safepay group on August 29, 2025, the group claims to have gained unauthorized access to the institution's systems. While the group has publicly identified Zanetti S.r.l. as a victim, the announcement currently contains only general information regarding the company's business operations. At this stage of the incident, the group has not shared any specific data samples or issued any ransom demands.

The group's announcement serves as a notification of the alleged compromise, but it lacks the granular details often seen in later stages of a breach. It is important to note that the information provided by the group is currently limited to the identification of the target and the assertion that a breach has occurred.

Data involvement and content

Regarding the specifics of the alleged breach, the listing does not provide details on the volume or nature of the files involved. The announcement names no specific data types that have been compromised.

About Zanetti S.r.l.

Zanetti S.r.l. is an organization based in Florence, Italy. The company specializes in the design and construction of glass and architectural structures, operating within the manufacturing sector.

Risk assessment and industry implications

The involvement of the Safepay group suggests a potential risk of data exposure due to the double-extortion tactics commonly employed by such actors. Double extortion is a method where attackers not only encrypt a victim's data but also steal it, threatening to leak the sensitive information on public forums if the ransom is not paid. This tactic increases the pressure on organizations to comply with demands.

For an Italy-based entity like Zanetti S.r.l., a confirmed data breach could lead to significant legal consequences. Under the General Data Protection Regulation (GDPR), organizations may face legal sanctions and administrative fines if they fail to protect personal data. Furthermore, because the company is involved in architectural projects and engineering, there is a risk regarding the exposure of intellectual property and trade secrets. If employee or customer information were to be compromised, it could lead to secondary risks such as identity theft or targeted phishing attacks.

Given that the Safepay group emerged in late 2024, continued monitoring of their operational capacity and motivations is necessary for threat intelligence purposes. Organizations in the manufacturing and architectural sectors can mitigate these risks by implementing robust security frameworks, ensuring regular backups of critical engineering data, and maintaining strict access controls to protect intellectual property.