SafePay Adds laconcepcion.com.mx in Mexico

SafePay has added laconcepcion.com.mx to its ransomware victim list, and the domain now appears in more than one independent tracker of the group’s activity. TheHackerWire listed it among SafePay’s recent victims with a discovery date of Sept. 15, 2026, and Mexico as the country, while Ransomware.live also logged it as a victim attributed to the same actor on that date.

What is known about the attribution?

The available attribution points to SafePay, but it does not on its own confirm a verified intrusion at the Mexican organization. The reporting gathered by the research system shows the domain appearing in Kalir.io’s Pulse, TheHackerWire, and Ransomware.live, which reinforces the public visibility of the group’s claim.

What profile is assigned to the victim?

According to an unconfirmed threat intelligence source, laconcepcion.com.mx would be a private health provider in the Coahuila region of Mexico. That identification comes from GalaxyWarden and should be read as a presumptive attribution, not as confirmation from the company or from authorities.

What context does the SafePay campaign show?

ZeroHour describes SafePay as an active actor with multiple victims recorded in the same time window, including triniticaring.org, neumerkel-gmbh.de, and marlinhvac.com. That context places the laconcepcion.com.mx case within a broader, ongoing campaign, although the available material does not report ransom amounts, data volume, or operational impact for the Mexican organization.