lewis-manning.org.uk Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 May 2025, the website lewis-manning.org.uk was listed by the ransomware group known as safepay. Public reporting indicates that the group claims to have carried out a ransomware attack in which internal files were exfiltrated. The number of people affected remains unknown, and further technical details of the incident have not been disclosed.

For an organisation involved in hospice and end-of-life care, any confirmed or claimed compromise of internal systems raises immediate questions about the security of operational records and personal information that such bodies typically hold. At this stage the listing itself is an unverified claim by the threat actor; independent confirmation of the full scope has not been published.

Breaking down the breach

According to available records, lewis-manning.org.uk appeared on safepay’s leak site on 24 May 2025. The sole concrete detail provided is that internal files were allegedly exfiltrated as part of a ransomware attack. No public information has been released about the precise date the intrusion began, the initial access method, the volume of data taken, or whether systems were encrypted in addition to the claimed theft. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s assertion that internal files left the organisation’s control, no further technical indicators or forensic findings have been made public.

Who is safepay?

Safepay is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the stolen material if a ransom is not paid. The group maintains a dedicated leak site on which it posts victim names and, in some cases, sample files. Like other contemporary ransomware crews, safepay has historically targeted a range of sectors, including healthcare and charitable organisations, because the sensitivity of the data often increases pressure to negotiate. Claims appearing on such sites are made by the attackers themselves and should be treated as unverified until corroborated by the victim organisation or independent investigators. No additional statements specifically about lewis-manning.org.uk beyond the listing itself have been reported.

About lewis-manning.org.uk

Lewis-Manning Hospice Care is a UK-based charitable organisation that provides specialist palliative and end-of-life care, support for patients and families, and related community services. Bodies of this type routinely process medical histories, care plans, contact details for patients and next of kin, staff records, and operational documents. Because the work involves highly personal and often time-sensitive information, any unauthorised access to internal systems carries particular weight. A claimed breach at such an organisation therefore matters not only for the charity’s own continuity of service but also for the privacy of people who may already be in vulnerable circumstances.

What was likely exposed

The only data category named in public reporting is “internal files” said to have been exfiltrated. Exact contents have not been disclosed. Organisations delivering hospice care typically hold patient medical and demographic records, family contact information, staff personnel files, volunteer details, financial and donor records, and internal operational documents. Whether any of these categories were among the files claimed by safepay remains unconfirmed. Until the organisation or independent analysis releases a verified inventory, the precise nature and volume of any exposed material cannot be stated as fact.

What's at stake

If internal files containing personal or medical information were indeed taken, affected individuals could face risks of identity misuse, targeted phishing, or unwanted contact. For patients and families already dealing with serious illness, the additional stress of potential data exposure is significant. From the organisation’s perspective, a ransomware incident can disrupt care coordination, damage trust among donors and the community, and create regulatory and reputational consequences under UK data-protection rules. Because the scale of the claimed exfiltration is unknown, the full extent of these risks cannot yet be quantified.

What to do if you're exposed

Anyone who has had contact with Lewis-Manning Hospice Care—patients, relatives, staff or donors—should remain alert for unexpected communications that reference personal details. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and other accounts, and treat unsolicited requests for information with caution. If you receive notification from the organisation itself, follow the guidance it provides. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, which can help prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.