Seguriamericas listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Colombia
• Sector: Professional Services
• Announcement date: December 17, 2025

A new threat actor claim against Seguriamericas

The Colombian private security firm Seguriamericas has been listed on the leak site of the ransomware group known as safepay. This announcement, which appeared on December 17, 2025, marks a significant development in the ongoing threat landscape facing professional service providers in the region. The listing indicates that the threat actor has targeted the organization, though specific details regarding the nature of the intrusion remain limited.

The group known as safepay has officially added the domain seguriamericas.com to its platform. According to the claims made by the attackers, they have successfully obtained data belonging to the company. Following the announcement, the group initiated a countdown, a common tactic used by ransomware operators to increase pressure on their victims. Publicly available information regarding the specific methods, tools, or background of the safepay group remains limited, making it difficult to attribute the attack to a specific known threat actor profile beyond their chosen moniker.

Details regarding the alleged data breach

While the threat actor has claimed to have access to the organization's data, the announcement lacks specific technical details. At this time, no information has been provided regarding the total size of the data allegedly stolen, nor has there been a disclosure of the specific number of files involved in the breach. Furthermore, the group has not issued a specific ransom demand in their public listing.

Regarding the content of the breach, the listing names no data types. No details or sample files regarding the content of the allegedly leaked data have been provided by the group. This lack of transparency is common in the early stages of a ransomware extortion attempt, where attackers often use the threat of publication to force a negotiation.

About Seguriamericas

Seguriamericas, formerly known as Seguridad Las Americas Ltda, is a company based in Colombia. The firm specializes in providing private security and investigation services. As a professional services entity, SeguriAmericas provides a variety of security solutions tailored to the needs of both individual and corporate clients, operating within the sensitive sector of private security.

Analysis and implications for the security sector

This incident suggests that the operational data and customer information of Seguriamericas may be at risk of exposure. Because the organization operates within the private security sector, a potential leak carries significant implications, as it could expose sensitive security protocols and confidential client data. Such a breach could potentially lead to legal sanctions for the company under Colombian data protection regulations.

The tactics employed by the group appear to follow the double extortion model. In a double extortion scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. The threat of publishing this data on a public leak site is used to coerce the organization into paying a ransom. This method exposes the company to secondary risks, such as targeted phishing campaigns or further attacks that utilize the stolen information.

For organizations operating in high-stakes sectors like private security, such incidents highlight the necessity of robust data protection frameworks. General defensive measures often include implementing strict access controls, maintaining comprehensive audit logs, and ensuring that sensitive security protocols are stored in isolated, highly secure environments. Additionally, organizations must prepare for the possibility of secondary attacks that leverage leaked information to target clients or employees through social engineering.