Ransomware Group: SAFEPAY

VICTIM NAME: mercercapital[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to Mercer Capital, a financial services firm based in the United States. The breach was discovered on June 7, 2025, and involved a cyberattack that compromised sensitive data. Mercer Capital specializes in business valuation, financial reporting, tax compliance, corporate advisory, litigation support, portfolio valuation, and investment banking. The breach could potentially expose confidential client information and internal documents, although specific data details are not publicly disclosed. The leak includes a screenshot of internal data, indicating that the attack may have targeted internal systems to steal financial and operational information. The threat actors behind the attack have made the data available for download via the provided dark web link, although no explicit PII or sensitive company identifiers are shared in the public report.

The attack appears to be part of a targeted campaign by a group associated with “safepay”. The breach highlights the importance of cybersecurity measures for financial institutions handling sensitive and valuable client data. The publicly shared screenshot suggests that internal documents or system layouts may have been accessed, but explicit content details are not presented in this summary. The leak could be intended to pressure Mercer Capital to meet ransom demands or to demonstrate the hackers’ capability to infiltrate high-profile financial organizations. Overall, the incident underscores ongoing cyber threats faced by firms within the financial sector, particularly those dealing with valuation services and confidential client information.