new-point.it Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with public leak-site listings, a pattern that has become routine across Europe’s mid-sized commercial sector. In that climate, the appearance of an Italian supplier on a criminal site is one more data point in a steady stream of claimed intrusions rather than an isolated shock.

On 3 August 2026, the ransomware group known as safepay listed new-point.it, stating that internal files had been exfiltrated. The number of people affected remains unknown, and public detail beyond the listing itself is limited. For customers, partners and staff connected to the firm, the claim is still worth understanding clearly.

Breaking down the breach

According to the available record, new-point.it was listed by safepay on 3 August 2026. The group’s claim is that internal files were taken in a ransomware attack. No confirmed figure for the volume of data, no technical description of the initial access method, and no independent verification of the exfiltration have been published in the material at hand. The count of individuals whose information may be involved is explicitly unknown. What is on record is the leak-site listing and the characterisation of the material as internal files obtained during a ransomware incident. Anything beyond that—precise timelines inside the network, ransom demands, or confirmation that encryption also occurred—has not been disclosed in the facts provided.

The group behind it: safepay

Safepay is a ransomware operation that has appeared in public reporting as a double-extortion actor: after gaining access, operators typically exfiltrate data and threaten to publish it if payment is not made, often alongside or instead of encrypting systems. Like other groups in this category, safepay maintains a leak site on which it names victims and, in some cases, releases samples or larger archives. Its activity has been tracked across multiple countries and sectors; the model relies on pressure created by the public listing itself. In this instance, the listing of new-point.it should be read as a claim by the group. No independent confirmation that the files were in fact taken, or of their full contents, is supplied in the record used here.

About new-point.it

New-point.it is headquartered in Signa, in the Florence area of Italy. The company was founded in 2006 and has grown into one of Italy’s established suppliers. Organisations of this type commonly sit in supply chains that handle commercial orders, logistics, customer and supplier records, and internal operational documents. A breach claim against such a firm matters because the data it holds—whether or not the exact sets are yet confirmed—often links the company to other businesses and to individuals who deal with it as customers or employees. Disruption or exposure can therefore extend beyond the single entity named on a leak site.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or personal-data categories is given, and the number of people affected is unknown. Companies in the supplier sector typically maintain procurement records, invoices, contracts, employee information, and customer or partner contact details. Those categories are normal for the industry; they are not confirmed as present in this incident. Until more specific inventories are published by the organisation or by credible investigators, the exact contents of the claimed exfiltration remain unconfirmed. Readers should treat any assertion of particular data fields as unverified unless corroborated.

Why it matters

When internal files are alleged to have left an organisation, the practical risks are straightforward. Individuals whose names, contact details or transactional history appear in those files may face phishing or social-engineering attempts that reference real relationships or orders. Partner companies may see commercial information used to craft more convincing fraud. For the organisation itself, a public listing can damage trust, trigger contractual notification duties, and require forensic and legal work even when the full scope is still being established. None of these outcomes depends on sensational language; they follow from the ordinary value of internal business records and the known behaviour of ransomware groups that monetise both encryption and publication threats. Because the scale here is undisclosed, the prudent stance is to assume that anyone with a meaningful relationship to new-point.it could be affected until clearer inventories appear.

If your data was in this breach

If you have dealt with new-point.it as a customer, supplier or employee, treat unsolicited messages that reference the company with extra caution. Prefer official channels you already trust when checking whether notification is coming. Change passwords on related accounts if you reused them, and enable multi-factor authentication where it is available. Monitor financial and email accounts for unusual activity. You can also run a free exposure scan of your email address to see whether it has already appeared in known breach data sets; that check does not confirm involvement in this specific incident, but it helps you gauge your wider exposure and prioritise further steps.

AICompiled with AI assistance from public sources and published under our editorial standards.