iql-nog.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 2, 2026, the ransomware group safepay listed iql-nog.com on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of people whose information may be involved is not known, and no further details about the scope or contents of the material have been released publicly. For individuals connected to the company through employment, supply chains, or business records, the listing raises the possibility that operational documents could contain identifying or sensitive information. The practical stakes center on the uncertainty. Without confirmation of specific data types or volume, those potentially affected cannot yet assess whether personal details, financial records, or proprietary information have been placed at risk of further distribution.

Inside the incident

The incident was first noted through safepay’s public listing on the reported date. The group claims to have obtained internal files, but provides no additional information on the method of access, the volume of data, or whether encryption was also deployed. No independent confirmation of the claims has been made public, and the organization has not issued a statement detailing its own findings.

Key elements such as the exact timing of the intrusion, the number of records involved, and any ransom demand remain undisclosed. The only confirmed element at present is the group’s assertion that files were taken.

Who is safepay?

Safepay is a ransomware operation that follows a double-extortion model. It typically encrypts systems and then threatens to publish stolen data unless a ransom is paid. The group maintains a leak site where it lists organizations it claims to have compromised, often after negotiations fail. Public reporting has associated safepay with intrusions into manufacturing, logistics, and other industrial sectors, though each listing represents an unverified claim by the group until corroborated by the victim or investigators.

Who is iql-nog.com?

iql-nog.com is a company founded in 1947 that produces oleochemical products, with a focus on fatty acid esters and related specialty chemicals. Organizations in this sector routinely manage technical specifications, customer and supplier records, production data, and regulatory compliance documentation. A compromise at such a firm can affect both commercial operations and any personal information tied to employees, partners, or regulatory filings.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types or data categories has been released. Companies of this kind commonly hold employee records, customer contracts, laboratory results, and supply-chain documentation, but the precise contents of the material claimed by safepay are unconfirmed.

Why it matters

Exposure of internal files can lead to secondary risks such as targeted phishing, misuse of business relationships, or regulatory scrutiny if personal data is later shown to be present. For the organization, the incident adds operational disruption and potential compliance obligations under data-protection rules. Individuals have no immediate way to determine their level of exposure until further details emerge or official notifications are issued.

What to do if you're exposed

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with major credit bureaus. Review any recent communications from iql-nog.com for official guidance. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.