Ransomware Group: SAFEPAY

VICTIM NAME: dreng[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to the website identified as “dreng.com,” which was compromised on May 6, 2025. The attack date is documented as May 6, 2025, and the incident was publicly discovered shortly afterward. The leak was associated with the threat group known as “safepay.” Despite the attack, there is no specific information available regarding the activity sector of the victim. The website is located in the United States. The page includes a screenshot illustrating the breach, indicating potential internal data or system information has been compromised. However, no detailed sensitive or PII data is revealed in publicly accessible content.

The leak appears to feature a link to a claim or verification page on a dark web Onion site, which is standard for ransomware groups to confirm victims or communicate with stakeholders. The presence of a screenshot suggests visual evidence of the breach or leaked material, but no explicit data or sensitive information is provided in the report. Notably, there are no details about the amount of data stolen or the specific types of information affected. The attack did not involve known employee or third-party data exposure based on available information. Overall, the incident illustrates the ongoing threat posed by ransomware actors targeting websites in the US, with minimal publicly disclosed details beyond the breach confirmation.