#SafePay
This archive collects reporting on one of the more active ransomware groups affecting the region, with emphasis on intrusion tactics, extortion methods, and operational patterns. It also brings together attribution analysis, tracking of activity changes, and context to understand the impact on organizations across Latin America.
SafePay and Aur0ra hit Argentina
Aur0ra confirmed victims in Argentina and Peru, while SafePay was named in a joint alert tied to more than 600 affected organizations.
Oct 30, 2026 · 3 min
ANWO and SafePay Leak Tied to Global Alert
SafePay published files attributed to ANWO, including severance records, contracts and personal data, amid a global alert with 600 victims.
Oct 29, 2026 · 2 min
SafePay Hits 600 Victims, Expands into LATAM
CISA and partners say SafePay has hit at least 600 victims since 2024, with activity in North and South America and claims in Argentina
Oct 26, 2026 · 37 min
CISA warns on SafePay and Qilin in critical infrastructure
CISA, the FBI and partners warned on SafePay, with about 600 critical infrastructure victims across the Americas, Europe
Oct 22, 2026 · 3 min
Mexico: SAFEPAY Added Auromex
SAFEPAY added Mexican manufacturer Auromex to its leak site. Security Arsenal also documented the group’s TTPs, and a note cited SCILabs.
Oct 2, 2026 · 2 min
Brazil appears in daily ransomware log
Ransom-DB logged Brazil among several ransomware targets, while a SAFEPAY report cited a case in Mexico.
Oct 2, 2026 · 2 min
INCAN restores radiotherapy after cyberattack
INCAN said radiotherapy has been back to normal since Sept. 11 after a cybersecurity incident affected the unit.
Sep 22, 2026 · 2 min
SafePay Adds laconcepcion.com.mx in Mexico
SafePay has added laconcepcion.com.mx to its victim list. Threat intelligence sources place it in Mexico and link it to a possible health provider.
Sep 17, 2026 · 2 min
Peru’s gob.pe listed as SafePay victim
Threat intel aggregators and accounts listed gob.pe as a SafePay victim. Peru has not confirmed any breach.
Sep 16, 2026 · 2 min