adlan.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
adlan.com has been listed by the safepay ransomware group, with internal files reported as exfiltrated in the attack. The incident came to light on May 18, 2026, and anyone with an account or prior relationship with the organisation should check for notices and change passwords or enable additional security steps if advised.
Breaking down the breach
The only confirmed information is the listing itself and the assertion that internal files were removed. No figure for the volume of data, the number of records, or the date of the intrusion has been made public. It is not known whether the files have been published or whether any ransom demand was paid.
Inside safepay
Safepay is a ransomware operation that publishes claims of compromise on a dedicated leak site when negotiations with a target stall. The group typically pairs encryption of systems with the removal of selected files, then uses the threat of disclosure to increase pressure. Its listings are presented by the group as evidence of access; independent confirmation of each claim is not always available at the time of posting.
Who is adlan.com?
Adlan.com was established in 1995 and provides IT infrastructure, network design, cybersecurity, disaster recovery, and managed technology services, primarily to smaller organisations. Companies in this sector routinely hold configuration details, client credentials, internal communications, and records related to the networks they administer.
What data was at risk
The listing refers only to “internal files.” The precise categories of information contained in those files have not been published. Organisations of this type commonly store administrative credentials, client contact details, network diagrams, and service logs, but the exact contents in this case remain unconfirmed.
Why it matters
Files taken from an IT service provider can include material that affects both the provider and its clients. If configuration data or credentials are present, they could be used for further unauthorised access. Individuals named in internal records may face increased risk of targeted phishing or account misuse, though the scale of any such exposure is not yet known.
What to do if you're exposed
Review recent account activity for any services you use through adlan.com or similar providers. Enable or strengthen multi-factor authentication on those accounts. Monitor official statements from the company for further detail. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
shw-fr.de Listed by safepay Ransomware Groupdia179.com Listed by safepay Ransomware Groupehg.bayern Listed by safepay Ransomware Groupseinordovest.it Listed by safepay Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the adlan.com Listed by safepay Ransomware Group →
Publicly posted by safepay — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.