morricetransportation.com Listed by safepay Ransomware Group

On April 4, 2025, Morrice Transportation appeared on the leak site of the Safepay ransomware group. The Canadian logistics company, based in Windsor, Ontario, is claimed to have had internal files exfiltrated following a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, anyone whose personal or business records passed through the firm’s systems could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that Safepay posted details of the Morrice Transportation breach on its dark-web leak site. The data consists of internal files exfiltrated during a ransomware incident. Morrice Transportation operates a fleet of more than 300 vehicles and provides cross-border freight, expedited shipping, and hazardous materials transport across North America. No confirmed total of affected records has been released, and the precise contents of the leaked files have not been independently verified by third parties.

Why This Matters for You and Your Family

When a logistics company like Morrice Transportation suffers a breach, the exposed internal files can contain names, addresses, phone numbers, dates of birth, driver’s license details, or payment information belonging to customers, contractors, and employees. If your family has shipped goods, used their expedited service, or been employed by a business that worked with them, your information may now sit in an attacker’s archive. Once stolen data surfaces on leak sites, it rarely disappears; it circulates among criminals who combine it with other breaches to build detailed profiles.

Ordinary families rarely think their moving boxes or pallet shipments could lead to identity theft, yet that is exactly how these incidents cascade. A single leaked address or phone number becomes the starting point for phishing calls, loan fraud, or account takeovers that can cost thousands of dollars and months of paperwork to repair.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently include email addresses, usernames, and notes that link digital handles to real-world identities. Attackers chain these fragments together: a work email from the breach can be matched to a personal account on another site, then to a child’s gaming username that shares the same password or recovery phone number. The result is a complete identity map that enables harassment, SIM-swapping, or targeted extortion. Credential leaks like this one regularly cascade into account takeovers precisely because people reuse passwords across business, personal, and gaming services.

Safepay Ransomware Group’s Track Record

Public reporting attributes the attack to the Safepay ransomware group. The group emerged in late 2024 and follows a double-extortion playbook: they first encrypt victim systems, then exfiltrate sensitive files before threatening to publish them unless a ransom is paid. Notable prior victims include other mid-sized logistics and manufacturing firms. Their typical approach involves initial access through phishing or exploited remote desktop services, followed by rapid data theft and publication on their leak site when negotiations fail. Exact attribution can be difficult, so statements about their history rely on patterns observed across multiple ransomware-tracking platforms.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Morrice Transportation or related logistics portals, and enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and your children’s gaming accounts, which often become the weakest link in these identity chains.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf.

The Morrice Transportation breach is a reminder that even routine business relationships can expose your family’s information without your knowledge. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next leak appears.