Ransomware Group: SAFEPAY

VICTIM NAME: olympusaero[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak pertains to Olympus Aero Group, an international aerospace company based in the United States. The organization specializes in sourcing and supplying aircraft engines and related materials, serving a global network of airlines, maintenance providers, and traders. The breach was identified on May 15, 2025, and the data leak is associated with the group’s online presence. The leak appears to include sensitive information that was targeted by threat actors, possibly involving data related to internal operations or strategic partnerships. The leak was publicly discovered shortly after the attack, and a screenshot of the compromised data portal is available, indicating the breach’s scope and severity.

The leak page features a screenshot of the compromised data portal, which may contain internal documents or confidential information. No specific evidence of PII or sensitive corporate data has been disclosed publicly, but the presence of download links and leak indications suggests that a portion of the company’s data was accessed or exfiltrated. The attack was attributed to a group identified as “safepay,” and ongoing investigations potentially aim to assess the extent of the security breach. The incident emphasizes the importance of cybersecurity for aerospace firms and highlights the increasing targeting of such critical infrastructure sectors by cybercriminals.