inttrust.gr Listed by safepay Ransomware Group

On December 14, 2025, Greek IT and consulting firm InTTrust S.A. appeared on the leak site of the safepay ransomware group, with attackers claiming to have exfiltrated internal files during a ransomware incident.

Reported Details of the Breach

Public reporting indicates that InTTrust, headquartered in Agia Paraskevi, Athens, and founded in 2006, had internal company files taken. The safepay group listed the victim on its dark-web leak site that day. Exact volume of data and number of individuals affected remain undisclosed in available reporting. The breach involved exfiltration of internal documents rather than a simple encryption-only attack.

Internal files were the primary data type exposed according to the group's posting. No public confirmation has emerged on whether customer records, employee personal data, or partner contracts were included.

Why This Matters for You and Your Family

When an IT services firm like InTTrust suffers a breach, the ripple effects often reach ordinary people. Many Greek businesses, public-sector organizations, and households rely on such consultancies for cloud services, email systems, payroll processing, or data storage. If your employer or a service you use contracted with InTTrust, your personal details may have been stored on the compromised systems.

Credential leaks from incidents like this frequently cascade into account takeovers that threaten family finances, children's online accounts, and home networks. Even if you never directly engaged with InTTrust, shared vendors or supply-chain connections can still expose you.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. Exposed internal files can contain spreadsheets linking employee names, email addresses, phone numbers, and client contacts. Attackers or opportunistic criminals then chain that information with data from previous breaches to build full identity profiles. A single leaked work email can lead to discovery of personal accounts, family addresses, and even children's gaming usernames.

These identity chains fuel doxxing campaigns, targeted phishing, and eventual extortion. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse passwords or email addresses tied to family domains. Once a handle is connected to a real identity through a breach like this, the risk of harassment or financial fraud increases sharply.

Safepay Group's Known Track Record

Public reporting attributes safepay with emerging in recent years as a ransomware operation that combines encryption with data theft and public shaming. The group has listed multiple organizations on its leak site, typically giving victims a short window to negotiate before releasing samples or full archives. Their playbook usually involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files and demands for payment to prevent publication. Notable prior victims have included companies across Europe, though specific details vary in open sources.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can break chains before criminals exploit them.
• Rotate any password you used at InTTrust or related services anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts which often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests and broker removals for you while you focus on securing accounts at home.

The incident underscores that ransomware groups continue to target service providers that handle data for everyday businesses and families. Taking concrete steps now limits the damage from this claimed breach and prepares you for the next one. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts.