More than half of SafePay's ransomware activity in Europe targeted German organisations.

2024 SafePay ransomware breach at a global BPO provider exposed nearly 17,000 employees and customers of a major commercial vehicle manufacturer, disclosed in January 2026 after a 14-month notification delay

SafePay claims a year-to-date total impact of 258 organizations and individuals across 29 distinct industries and 30 countries.

IncRansom, SafePay, and Qilin together accounted for 30% of the 118 healthcare organizations that were victims in Q3 2025.

There was a 36% decrease in SafePay's impact on organizations and individuals quarter-over-quarter.

SafePay claimed 11 healthcare organizations as victims in Q3 2025.

SafePay impacted 71 organizations and individuals across 19 industries and 16 countries in Q3 2025.

SafePay impacted 111 organizations and individuals spread across 27 industries and 18 countries in Q2 2025.

SafePay dropped to fourth place of most active threat groups in June 2025 with 27 attacks.

SafePay's activity increased by 42% in Q2 2025 compared to Q1 2025.

Safepay was the third most active threat group in March, with 42 attacks.