On April 11, 2025, Don Owen Tire Service in Bloomington, Illinois, appeared on the leak site of the safepay ransomware group. The company, which has provided tire sales, alignment, brake repair, oil changes and other automotive services since 1986, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people affected remains unknown, any customer, employee or vendor whose personal information passed through the company’s systems could now be exposed.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch donowentire.com
Get alerted the next time donowentire.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about donowentire.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that safepay posted details of the incident on its dark-web leak site, accessible via the onion address linked through ransomware.live. The data consists of internal files exfiltrated after the ransomware operators encrypted systems at Don Owen Tire Service. No confirmed list of specific record types such as names, addresses, phone numbers or payment details has been publicly detailed, but ransomware incidents of this nature routinely involve customer invoices, repair orders, employee records and vendor contracts. The posting date of April 11, 2025 marks the point at which the group began threatening to publish or sell the stolen data if demands were not met.
Why This Matters for You and Your Family
When a local business like your neighborhood tire shop suffers a breach, the impact reaches far beyond the company. If you or any member of your family has ever had a vehicle serviced there, your name, address, phone number, vehicle identification number or payment information may have been stored in the compromised files. That information can be combined with data from other breaches to build a detailed profile. Once criminals possess enough pieces, they can open accounts in your name, file fraudulent tax returns, or target your family with convincing phishing attacks. Children’s information is especially vulnerable because many parents use the same email or phone number across family accounts, creating a single point of failure that reaches school forms, sports registrations and online gaming profiles.
The Doxxing and Identity-Chain Implications
Stolen internal files often contain more than isolated records. Repair orders frequently list home addresses, phone numbers, email accounts and sometimes driver’s license numbers. These details act as bridges that link your online handles to your real-world identity. A single leaked email can lead to account takeovers on shopping sites, social media and gaming platforms. Public reporting describes how such chains accelerate doxxing: once criminals control one account, they harvest contacts, stored payment methods and password-reset tokens to compromise others. Gaming accounts belonging to you or your children are frequent secondary targets because they often reuse credentials and contain linked payment information or chat logs that reveal additional personal details.