estrumar.es Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Metálicas Estrumar, operating as estrumar.es, was listed by the safepay ransomware group on 29 December 2025. The listing states that internal files were exfiltrated during a ransomware attack. No figure has been released for the number of individuals affected, and the company has not issued a public statement confirming or denying the claims.

The incident is notable because estrumar.es is a Spanish industrial firm whose operations involve client contracts, engineering specifications and supply-chain records. Any confirmed exposure of such material would affect both the organisation and third parties whose information appears in those files.

Inside the incident

Public reporting of the event is limited to the safepay listing dated 29 December 2025. The entry asserts that files were taken from estrumar.es systems during a ransomware operation. No additional details on the timing of the intrusion, the volume of data, the encryption status of systems or the method of initial access have been disclosed by either the group or the company.

The group behind it: safepay

Safepay is a ransomware operation that maintains a public leak site to list claimed victims. The group typically combines file encryption with data exfiltration and then publishes samples or directories to pressure organisations into negotiations. Its listings have appeared regularly since 2024, covering targets in manufacturing, logistics and professional services across Europe and North America. In this case the group claims estrumar.es as a victim; that claim remains unverified by independent sources.

estrumar.es and its sector

Metálicas Estrumar is a metal-fabrication and structural-engineering company based in Burgos, Castilla y León. Firms in this sector routinely store technical drawings, material specifications, client project files, employee records and supplier agreements. A breach that exposes these records can reveal proprietary designs or contractual terms that competitors or counterparties would otherwise not see.

The information in question

The only data category named in the listing is “internal files.” No inventory of file types, no count of records and no confirmation that personal data of customers or staff were included have been published. Organisations of this type commonly retain personal identifiers, financial details and project documentation, yet the precise contents of the exfiltrated material remain unconfirmed.

The real-world impact

Exposed internal files could lead to loss of competitive information, disruption of ongoing projects and additional costs for incident response and system restoration. If personal data of employees or clients were present, those individuals face the standard risks of identity misuse or targeted fraud. At present the scale of any such exposure is unknown, so the extent of downstream effects cannot be quantified.

What to do if you're exposed

Individuals who believe their information may have been involved should monitor bank and email accounts for unusual activity and enable multi-factor authentication on all services that support it. Changing passwords for any reused credentials is a prudent first step. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.