simonrack.com Listed by SafePay Ransomware Group

On August 03, 2026, the ransomware group Safepay listed simonrack.com on its leak site, claiming the Spanish manufacturer of metal shelving systems had been hit by a ransomware attack in which internal files were exfiltrated. The company, headquartered in Alfamén, Zaragoza, and operating since 1964, has not publicly confirmed the claim as of this writing. This means the claims remain unverified by any official company notification, regulator filing, or government disclosure.

Leak-Site Claims

The Safepay leak-site posting states that internal files were exfiltrated during a ransomware attack. The listing does not specify the volume of data taken, the exact types of records involved, or any ransom demand. According to the post, the company was given a deadline to negotiate before additional material would be published. Because the only primary source is the threat actor’s own leak site (mirrored on ransomware.live), these details constitute an unconfirmed claim rather than an established breach. Simon Rack has issued no public statement acknowledging the incident.

Why This Matters for You and Your Family

When a company that has done business with customers, suppliers, or employees is listed in this way, personal information tied to those relationships can end up in criminal hands. Even if the leak-site listing does not detail customer records, employee data, or financial documents, the exposure of internal files often includes spreadsheets, contracts, invoices, or email archives that contain names, addresses, phone numbers, email addresses, and sometimes national identification numbers. Any such data increases the chance that you or your family could face targeted phishing, identity theft, or follow-on fraud. The fact that the victim is a long-established European manufacturer does not limit the risk; once data leaves the company’s control, it can be traded or used anywhere.

Doxxing and Identity-Chain Risks

Leaked internal files frequently create doxxing chains. A single email address or phone number found in a supplier spreadsheet can be cross-referenced with breached gaming accounts, social-media handles, or family-member records. Children’s usernames or school-related emails that appear in parent-company correspondence are especially valuable to attackers because they often share the same home address. This linkage turns one corporate incident into persistent personal exposure. Credential reuse across work, personal, and gaming accounts makes the cascade faster and more damaging.

Safepay Ransomware Group Track Record

Public reporting attributes Safepay with emerging in late 2025 as a double-extortion operation. The group typically gains initial access through phishing or exploited remote desktop services, exfiltrates data before deploying ransomware, and then pressures victims by threatening to publish sensitive files on its onion site. Notable prior victims listed by the group include mid-sized manufacturing and logistics companies across Europe and Latin America. Their playbook relies on public shaming and timed data dumps rather than immediate mass publication, giving victims a short negotiation window that often expires without resolution. The group’s leak site remains one of the more active extortion platforms currently operating.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, handles, and real-world identity, then use the cleanup of Warden to begin removal requests.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and 100+ platforms so the next time your information surfaces it is caught and acted on within hours rather than months.
• Rotate any password you have ever used at simonrack.com or related supplier portals anywhere it is reused, and switch to 2FA via an authenticator app instead of SMS.
• Let remediation specialists handle takedown requests across data brokers and exposed databases for you, especially if home address or family contact details appear in the eventual published files.
• Treat any unexpected communication claiming to be from Simon Rack with extreme caution and verify it through official published channels before responding.

The incident underscores a persistent reality: corporate compromises continue to place ordinary customers and employees in the crosshairs long after the initial attack. A single unconfirmed ransomware listing can still trigger months or years of follow-on risk if the exposed data is repackaged and sold. DoxxScan by GalaxyWarden, with its continuous monitoring across 13.1 billion-plus breach records and 100-plus platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, remains one of the most practical tools available for individuals who want to locate and reduce their own exposure. Acting early on the signals provided by these leak-site claims can limit how far attackers are able to travel down your personal identity chain.