Ransomware Group: SAFEPAY

VICTIM NAME: estudiolm[.]com[.]ar

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to an Argentine company operating within the architecture and engineering sector. The company, identified by its domain “estudiolm.com.ar,” specializes in innovative and sustainable design solutions for a wide range of projects, including residential and commercial developments. The leak was discovered on May 26, 2025, and it is associated with the group named “safepay.” The data leak includes a screenshot of the compromised website, which appears to be an official representation of the company’s online presence, highlighting its professional focus. The attack was publicly claimed via a Tor URL, indicating the threat actor’s intent to showcase the breach and potentially leak confidential information. Despite the breach, there is no detailed information about the specific data compromised, and the activity listed is “Not Found,” suggesting that any sensitive details may have been redacted or not included in the leak. The leak date and claim indicate the victim’s operational details and underscore ongoing cybersecurity risks to firms in the architecture industry in Argentina. The presence of a screenshot suggests that internal or public-facing materials may have been exposed, although specific files or data have not been confirmed to be leaked.

The leak page features a link to an access claim via the Tor network, with a publicly available screenshot of the compromised website, which could include internal documents or project plans. The company is described as a leader in sustainable contemporary solutions committed to environmental responsibility, emphasizing its professional reputation. The attack’s timing, roughly a week after discovery, indicates a swift response to the breach. The incident underscores the importance of cybersecurity for companies handling sensitive project information and client data, especially in sectors involved in public and private development. Overall, the leak appears to be part of a broader campaign by cybercriminals targeting organizations in South America, with the specific details of what has been compromised remaining unspecified among the available evidence.