Ransomware Group: SAFEPAY

VICTIM NAME: itca[.]edu[.]sv

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the SAFEPAY Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page associated with the victim, ITCA, located in El Salvador, reveals significant details regarding the organization’s operations and the extent of the breach. ITCA operates in the Education sector and has reported a revenue of approximately $56.5 million. The data breach was discovered on December 25, 2024, and details indicated that the organization has 15 employees, 676 users, and substantial engagement with third parties, which included 552 individuals connected to the institution. This context could imply potential risks to user data and institutional integrity given the third-party affiliations and user interactions.

Furthermore, the leak suggests that 63 URLs related to the provided user data may be affected, raising concerns over the security of personal and institutional data. Despite the absence of a specific compromise date within the extracted information, the findings suggest a thorough examination of the organization’s cybersecurity posture is imperative moving forward. The post did not provide download links or screenshots of sensitive data, yet raised significant awareness of the potential vulnerabilities faced by educational institutions like ITCA. The information reflects ongoing challenges in network security and emphasizes the need for enhanced protective measures against similar cyber threats.