mactavishco.ca Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 19, 2025, the ransomware group Safepay listed mactavishco.ca on its site and claimed to have carried out a ransomware attack against the organization. The number of people whose information may be involved is not known, and the company has not issued a public statement confirming or detailing the incident. The practical stakes for individuals connected to the retailer center on the possibility that internal records containing personal or transaction details have left the organization’s control. Without confirmed information on the contents or volume of any exfiltrated material, those potentially affected have limited visibility into their exposure.

Breaking down the breach

The only confirmed public detail is the listing itself on November 19, 2025. The group claims internal files were exfiltrated during a ransomware attack. No information has been released on the number of records involved, the exact date of the intrusion, or the method used to gain access. The scale of impact on customers, employees, or business partners remains undisclosed.

Inside safepay

Safepay is a ransomware group that follows the common pattern of encrypting victim systems while also copying data and then posting claims on a leak site. The group’s listings are presented as evidence that stolen material will be published unless demands are met. In this case the listing of mactavishco.ca constitutes an unverified claim by the group; independent confirmation of the data theft has not been reported.

About mactavishco.ca

MacTavish & Co. operates as a small boutique retailer in Medicine Hat, Alberta, offering curated home décor and gifts. Organizations of this type routinely collect customer contact information, purchase histories, and payment details to process orders and manage loyalty programs. A compromise at such a business can therefore touch both personal identifiers and financial records even when the precise data set remains unknown.

What data was at risk

The only description provided is that internal files were allegedly exfiltrated. The specific categories of information contained in those files have not been disclosed. Retail operations of this kind commonly store names, addresses, email addresses, order details, and payment card information, yet it is not confirmed whether any of these data types were among the material claimed to have been taken.

Why it matters

Even without a confirmed count of affected individuals, the exposure of internal files from a retailer can create downstream risks such as account takeover attempts or misuse of contact information for targeted scams. For the organization, the incident adds operational disruption and potential regulatory obligations under Canadian privacy law. The absence of detailed disclosure leaves both the business and its customers without a clear picture of the scope.

What to do if you're exposed

Individuals who have shopped at the store or provided contact details can monitor their email and financial accounts for unusual activity and consider placing fraud alerts with credit-reporting agencies. Changing passwords for any accounts linked to the retailer and enabling multi-factor authentication are immediate steps that reduce further risk. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.