Ransomware Group: SAFEPAY

VICTIM NAME: triangleheatingcooling[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The analyzed ransomware leak page pertains to the website of Triangle Heating & Cooling, a service provider specializing in HVAC solutions within Randolph County, West Virginia. The breach was discovered on June 7, 2025, and the attack date is recorded as June 7, 2025, at 17:40. The publicly leaked content includes general company information, highlighting their focus on high-quality work and customer satisfaction in heating and cooling services, including installations, repairs, and maintenance of HVAC systems. The leak features a screenshot showcasing internal data or relevant visuals related to the incident.

The leak page indicates that the incident is associated with the “safepay” group, which may suggest ransomware involvement targeting business operations. There are no indications of data being sold or linked to third parties, and the leak appears focused on exposing internal information without revealing PII or sensitive customer details. The leak may include computer data or internal documents relevant to the company’s operations. A download link suggests that victims or researchers may access compromised data or proof of breach, but specific contents are not disclosed here. The company’s industry classification indicates they provide essential services related to heating and cooling systems, serving local residents and businesses. Additional contextual information is minimal, emphasizing the breach’s exposure without compromising private or sensitive data.