#SAFEPAY
This archive collects reporting on one of the more active ransomware groups affecting the region, with emphasis on intrusion tactics, extortion methods, and operational patterns. It also brings together attribution analysis, tracking of activity changes, and context to understand the impact on organizations across Latin America.
Mexico: SAFEPAY Added Auromex
SAFEPAY added Mexican manufacturer Auromex to its leak site. Security Arsenal also documented the group’s TTPs, and a note cited SCILabs.
Oct 2, 2026 · 2 min
Brazil appears in daily ransomware log
Ransom-DB logged Brazil among several ransomware targets, while a SAFEPAY report cited a case in Mexico.
Oct 2, 2026 · 2 min
INCAN restores radiotherapy after cyberattack
INCAN said radiotherapy has been back to normal since Sept. 11 after a cybersecurity incident affected the unit.
Sep 22, 2026 · 2 min
SafePay Adds laconcepcion.com.mx in Mexico
SafePay has added laconcepcion.com.mx to its victim list. Threat intelligence sources place it in Mexico and link it to a possible health provider.
Sep 17, 2026 · 2 min
Peru’s gob.pe listed as SafePay victim
Threat intel aggregators and accounts listed gob.pe as a SafePay victim. Peru has not confirmed any breach.
Sep 16, 2026 · 2 min