usdaw.org.uk Listed by safepay Ransomware Group

On December 29, 2025, the Safepay ransomware group added usdaw.org.uk to its public leak site, claiming that it had exfiltrated internal files from the Union of Shop, Distributive and Allied Workers, one of the United Kingdom’s largest trade unions.

What's Publicly Reported from Reporting

Public reporting indicates the union suffered a ransomware attack in which attackers gained access to internal systems and removed sensitive files. The Safepay group published proof of the breach on its dark-web leak site, listing usdaw.org.uk as a victim. Exact numbers of people affected remain unknown, but the data includes internal documents that could contain member names, contact details, employment records, and other personal information. No ransom payment status has been disclosed, and the union has not yet released a detailed public statement on the volume or exact nature of the stolen records.

Why This Matters for You and Your Family

When a large membership organisation like Usdaw is breached, ordinary working people and their households are placed at risk. Internal files often hold addresses, phone numbers, dates of birth, national insurance numbers and email accounts — exactly the building blocks criminals need to open accounts in your name, apply for credit, or target you with convincing phishing messages. If you or any member of your family belongs to a trade union, shop works in retail, or has ever had data held by such an organisation, this incident is relevant to you. Children’s details sometimes appear in family membership records, creating long-term exposure that can follow them into adulthood.

The Doxxing and Identity-Chain Risk

Stolen internal files rarely stay isolated. Attackers combine them with data from earlier breaches to build detailed profiles. A union membership record that links your name to an email address can be chained with a password leak from a shopping site, a phone number from a past breach, and a child’s gaming username. This creates a complete identity map that makes doxxing, targeted harassment, or account takeover far easier. Credential leaks of this kind frequently cascade into gaming platforms, where children’s accounts become entry points for further extortion or identity theft.

Safepay’s Publicly Known Track Record

Public reporting attributes Safepay with emerging in 2024 as a ransomware operation that combines double-extortion tactics with selective data leaks. The group has previously listed healthcare providers, local government bodies and membership organisations. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. It then demands payment and, if unmet, publishes samples on its leak site to pressure victims. The addition of usdaw.org.uk fits this pattern of targeting organisations that hold large volumes of personal data about ordinary citizens.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames and real identity so you can see exactly what this claimed breach has exposed.
• Rotate any password you used on usdaw.org.uk or related union portals anywhere else it is reused, and switch on two-factor authentication with an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become targets when credential leaks like this one create doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing day-to-day accounts.

The incident shows how quickly membership data can surface on ransomware leak sites and why waiting for official notifications is no longer enough. Start your DoxxScan trial today and put continuous monitoring, identity-chain mapping, and hands-on specialist remediation to work for your entire family, including gaming accounts that can otherwise turn one breach into years of problems. Taking these steps now limits what criminals can build from the Usdaw files and similar leaks that will inevitably follow.