Ransomware Group: SAFEPAY

VICTIM NAME: tdunhamcpa[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to the online presence of a certified public accountant operating in Jackson, Wyoming, based in the United States. The victim’s domain, dedicated to tax preparation, financial planning, and related services, was compromised on June 24, 2025, at approximately 21:12 UTC. The attacker group identified as “safepay” appears to have targeted this financial services website, potentially aiming to extract sensitive data, though no specific information about the nature of the breach or data stolen is provided.

The page features a screenshot illustrating some aspect of the victim’s online environment, but it does not contain explicit details about compromised data, PII, or confidential client information. The leak indicates that the attacker claims to have access to data stored on the victim’s server, and there is mention of an available claim URL through the dark web portal, suggesting a publicly accessible negotiation or data recovery process. The victim activity is categorized under financial services, and no user or employee data appears to have been compromised, according to available information.