Ransomware Group: SAFEPAY

VICTIM NAME: biglevel[.]net

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to a cybersecurity incident involving the domain biglevel.net, which operates within the technology sector in the United States. The attack was discovered on May 6, 2025, approximately two minutes after the initial report, indicating a rapid identification of the breach. The data leak was associated with a threat group identified as “safepay,” and evidence suggests that sensitive information from the victim may have been compromised. The page includes a screenshot that appears to display internal documents or data related to the incident, providing visual evidence of the breach.

Although specific details about the nature of the leaked data are not disclosed, the page indicates the presence of data exposure and the potential for further information to be made available through the provided claim URL. No personal or employee-related information is explicitly mentioned or appears to have been affected, but the leak signifies a serious security incident involving the victim’s digital infrastructure. The role of the threat group, “safepay,” suggests an organized cybercriminal operation targeting technology firms. The overall content underscores the importance of cybersecurity measures and awareness in preventing such breaches.