ibague.losolivos.co Listed by safepay Ransomware Group

On May 7, 2025, the Colombian funeral services company Los Olivos, operating as ibague.losolivos.co in Ibague, appeared on the leak site of the safepay ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that could affect customers, employees, and anyone whose personal information was stored in the company’s systems.

What's Publicly Reported from Reporting

Public reporting indicates that safepay listed the Ibague-based funeral home after claiming to have stolen internal documents. The company provides funeral plans, crematorium services, cemetery plots, wake rooms, transportation, posthumous tributes, and psychological support to grieving families. No exact victim count has been released, and the precise volume or type of records taken remains unclear beyond the description of internal files. The listing appeared on the group’s onion site, which is tracked by ransomware monitoring platforms such as ransomware.live.

Why This Matters for You and Your Family

When a local business that handles sensitive personal information suffers a breach, the consequences reach far beyond the company. Families who arranged funerals, shared death certificates, provided contact details for payment plans, or discussed private matters during bereavement may now have that information in the hands of criminals. Employees’ payroll records, supplier contracts, and internal correspondence could also be exposed. Once data leaves a secure environment, it rarely stays contained. You and your family may face increased risks of identity theft, targeted scams, or unwanted solicitations built around deeply personal life events.

The Doxxing and Identity-Chain Implications

Stolen internal files from a funeral services provider often contain names, addresses, phone numbers, email accounts, national ID numbers, and family relationships. Attackers can combine this information with data from previous breaches to build detailed profiles. A single leaked phone number or email can link gaming accounts, social media handles, and family members’ profiles. Credential leaks like this one frequently cascade into account takeovers, especially for gaming platforms used by children or teenagers who reuse passwords. The chain can lead to doxxing, harassment, or financial fraud that starts with funeral records but ends with compromised bank accounts or stolen identities across the household.

Safepay Group’s Known Track Record

Public reporting attributes safepay with emerging in late 2024 as a ransomware operation that combines double extortion tactics with leak-site publication. The group has targeted organizations across Latin America and other regions, typically gaining initial access through phishing or exploited remote desktop protocols, exfiltrating data before encrypting systems, and then demanding payment to prevent publication. Notable prior victims include mid-sized companies in healthcare, education, and local government sectors. Their playbook relies on pressuring victims with deadlines and gradually releasing sample files to demonstrate the seriousness of the threat.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in this or earlier incidents.
• Rotate any password you used at losolivos.co or related services anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points for identity-chain attacks after credential leaks like this one.
• Let remediation specialists handle data broker takedowns and removal requests on your behalf while you focus on securing accounts and monitoring for suspicious activity.

The incident shows how even businesses providing essential end-of-life services can become gateways for identity compromise that lasts years. Taking deliberate steps now limits how far attackers can travel along the chain that begins with this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information before criminals put the pieces together.