Safex.us listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: United States
• Sector: Transportation
• Announcement date: November 19, 2024

The ransomware group known as safepay has officially listed the transportation company Safex.us on its leak site. According to an announcement made by the group on November 19, 2024, the organization has been targeted in a cyberattack involving significant data exfiltration.

Details of the claim

The safepay group published a notice claiming to have successfully compromised data belonging to Safex.us. While the announcement was made in mid-November, the group claims the actual attack took place on October 23, 2024. In their communication, the threat actors identified the organization as having an annual revenue of 5.4 million dollars.

The group is currently employing a double-extortion strategy against the target. In such scenarios, ransomware actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information beforehand. The threat of publishing this stolen data on public leak sites serves as additional leverage to pressure the victim into paying a ransom. By threatening to release the information, the attackers aim to maximize the pressure on the organization's leadership.

Data involved in the incident

Regarding the specific content of the breach, the group claims that 70 GB of data has been exfiltrated from the organization's systems. However, the listing does not provide detailed information regarding the specific nature of the leaked data, and no screenshots have been provided to verify the contents of the stolen files. The listing names no specific data types.

Organization profile

Safex.us is an organization operating within the transportation sector. Based in the United States, the company is subject to the regulatory landscape of its jurisdiction, which includes potential state-level data protection laws and various legal sanctions depending on the impact of the breach.

Impact and assessment

The use of double-extortion tactics by the safepay group carries significant risks for the organization. Such an approach can negatively impact the company's operational processes and damage its commercial reputation. Depending on the actual content of the leaked data, the exposure of sensitive information belonging to employees or customers could potentially lead to identity theft and the execution of targeted phishing attacks against the affected individuals.

Because the safepay group has limited publicly available information associated with them, it remains difficult to accurately assess the group's specific attack capabilities or predict their future actions. This lack of transparency is a common challenge for threat intelligence when dealing with emerging or low-profile ransomware groups.

For organizations operating in the transportation sector, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against phishing. Furthermore, ensuring compliance with regional data protection regulations is a critical component of managing the legal and reputational risks associated with potential data exposure.