brunetti.com Listed by safepay Ransomware Group

On January 14, 2025, the ransomware group Safepay added brunetti.com to its leak site and began publishing what it claims are internal files exfiltrated from the popular Melbourne Italian cafe chain.

What's Publicly Reported from Reporting

Public reporting indicates that Brunetti, founded in 1985 and known for its cafes, catering, and online ordering services across Melbourne, was listed on the Safepay ransomware leak site. The group states it exfiltrated internal files during a ransomware attack. The exact number of people affected remains unknown, and the specific types of data contained in the published files have not been independently verified. The primary source for this incident is the Safepay leak site itself, indexed by ransomware.live at the onion address provided at the end of this article.

Available reporting describes the posting as part of Safepay’s standard tactic of pressuring victims by publicly threatening to release stolen data. No Reported Details have emerged about how the attackers initially gained access or the volume of data involved.

Why This Matters for You and Your Family

When a business like Brunetti suffers a breach, the information exposed often includes details that can be linked back to ordinary customers, suppliers, or employees. Internal files from a company that handles catering orders, takeaway accounts, and loyalty programs can contain names, addresses, phone numbers, email addresses, and payment information. Once that data reaches a public leak site, it becomes freely available to identity thieves, scammers, and harassers.

Your family’s exposure does not end with one company. A single leaked email or phone number can unlock other accounts where the same credentials were reused. For many families this means the risk spreads from a restaurant’s database into personal banking, children’s school portals, or family streaming services within days.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. Attackers and subsequent opportunists often combine the newly released files with information already circulating on forums and breach repositories. This creates an identity chain: an email from the Brunetti files links to a username on a gaming platform, which links to a home address, which leads to further personal details. The result can be doxxing, targeted phishing, or account takeovers that affect every member of a household.

Credential leaks like this one cascade into gaming account compromises. Children’s Roblox, Fortnite, or Steam accounts tied to a parent’s email are frequent targets once the parent’s details appear in a fresh leak. What begins as a restaurant breach can end with a child losing years of in-game progress or facing harassment in voice chat.

Safepay’s Publicly Known Track Record

Public reporting attributes the Safepay ransomware group with emerging in late 2023. The group has claimed responsibility for attacks on a range of organisations, typically small-to-medium businesses in retail, hospitality, and professional services. Its playbook follows a now-familiar pattern: gain initial access, often through phishing or exploited remote desktop services, exfiltrate data before encrypting systems, then demand payment while maintaining a leak site to apply public pressure. Safepay’s extortion style relies on timed deadlines and the gradual release of sample files to demonstrate the seriousness of its threats.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password used at Brunetti anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf.

The speed with which leaked data travels means families must act before opportunists stitch together the next link in the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who also protect gaming accounts belonging to you or your children. Starting that process promptly gives you the best chance of limiting damage from incidents like the Brunetti breach.