Ransomware Group: SAFEPAY

VICTIM NAME: profile-ind[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The reported ransomware incident involves the domain “profile-ind.com,” which is located in the United States. The attack date is documented as July 7, 2025, indicating a recent compromise. The leak page reveals that the ransomware group responsible is identified as “safepay.” Visual evidence includes a screenshot displaying internal data or a related interface, which provides a visual confirmation of the breach. Notably, the leak does not specify the nature of the compromised data, such as personal or company information, but the site suggests that sensitive data may have been targeted. The presence of download links or leaked files is implied, although explicit details or URLs are not provided. The threat actor’s profile includes minimal information about affiliated personnel or third parties, emphasizing a focus on their specific operations.

The attack appears to be part of a broader campaign by the “safepay” group, which is known to engage in infostealer activities. The threat group’s activity indicates an emphasis on stealing and potentially encrypting data for ransom purposes. The leak page includes visual documentation such as a screenshot of internal data or system interfaces, which could suggest the scope of the infiltration and the potential severity of the breach. While explicit details about the leaked data are not shared publicly, the publication of this information typically signals the potential exposure of sensitive or proprietary information. Due to the nature of these incidents, ongoing monitoring and investigation are recommended to assess contamination risks and mitigate further damage.