smp.cat listed on safepay leak site

• Ransomware group: safepay
• Country: Spain
• Sector: Professional Services
• Announcement date: May 6, 2026

The Spain-based healthcare organization smp.cat has been listed on the leak site by the group known as safepay. The group claims to have obtained access to the organization's data, marking a new potential incident involving a provider in the professional services sector.

The claims made by safepay

The ransomware group safepay has listed the organization smp.cat on their leak portal. According to the announcement, which was created on May 6, 2026, the group claims to have successfully gained access to the organization's internal data. This type of announcement is a common tactic used by ransomware actors to pressure victims into meeting specific demands.

The announcement includes descriptive information regarding the entity's operations, providing context about the organization's role within its industry. However, the specific details regarding the nature of the alleged leaked data in the announcement remain unknown. The provided screenshot contains only general information about the organization's profile, and no specific details were provided regarding the volume of data or the specific files involved in the alleged breach.

Data involved in the incident

Regarding the specifics of the alleged data theft, the listing names no data types. There is no information available concerning the specific nature of the files, the total size of the data, or the total file count associated with this claim. Furthermore, no ransom demand has been specified in the public announcement.

Organization profile

The target of this alleged attack, smp.cat, is a private healthcare organization operating in the Catalonia region of Spain. Founded in 1993, the entity provides essential services within the hospitals and physicians clinics sector, serving the local population in its specific region.

Implications and sectoral risks

Given that the organization operates in the healthcare sector, a potential data breach may pose significant risks to patient privacy. The sensitive nature of medical records and personal health information makes healthcare providers a high-value target for cybercriminals. Because the entity is based in Spain, the situation may be subject to GDPR regulations and could trigger relevant legal procedures regarding data protection and privacy compliance.

The threat of double extortion

The use of double extortion tactics by the safepay group suggests that the organization may face the threat of data publication. In a double extortion scheme, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. The threat of leaking this information publicly is used to coerce the victim into paying a ransom, even if they have backups to restore their systems.

Such incidents could lead to operational disruptions and reputational damage for the organization. Beyond the immediate impact on the business, these breaches can create secondary risks such as identity theft for the affected individuals whose personal information may have been compromised. For organizations in the healthcare sector, maintaining robust cybersecurity frameworks, implementing strict access controls, and ensuring continuous monitoring are vital steps to mitigate these evolving threats.