OMINT Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to dominate the cyber-threat landscape in 2024, routinely combining encryption with data theft and public leak-site postings to pressure organisations into paying. Against that backdrop, the listing of OMINT by the safepay ransomware group on 27 September 2024 is one more instance of a double-extortion claim that leaves the precise scope of compromise still unclear to the public.

What is known is limited: safepay asserts that it has taken internal files from OMINT in a ransomware attack. No independent confirmation of the intrusion, the volume of data, or the number of people affected has been published. The incident therefore sits in the familiar grey zone of modern ransomware reporting—serious enough to warrant attention, yet short on verified detail.

Inside the incident

On 27 September 2024, OMINT appeared on the leak site operated by the safepay ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. Public reporting supplies no further technical particulars: the initial access vector, the duration of the intrusion, the encryption status of systems, or any ransom demand remain undisclosed. The number of people whose information may have been involved is listed as unknown. The only additional figure attached to the organisation in the available summary is annual revenue of $540.7 million. Beyond the group’s claim that internal files were taken, no confirmed inventory of the stolen material has been released.

Who is safepay?

Safepay is a ransomware operation that emerged in the public eye in 2024 and follows the now-standard double-extortion model. After gaining access to a network, the group typically encrypts systems and simultaneously copies data, then threatens to publish the material on its dedicated leak site if payment is not received. Like other contemporary ransomware crews, safepay posts victim names and sample files as leverage, often without providing exhaustive proof of the full data set. Its activity has been observed across multiple sectors and geographies, but the group does not issue detailed technical advisories or claim responsibility for every intrusion in the same manner as older, more communicative actors. In this case, the listing of OMINT should be treated as an unverified claim by the group rather than as independently confirmed fact.

OMINT and its sector

OMINT is a substantial organisation reporting revenue of $540.7 million. Entities of this scale commonly operate in regulated industries that handle large volumes of personal, financial or operational data—most often healthcare, insurance or related professional services. Such organisations typically maintain extensive records on clients, employees, medical or contractual histories, billing information and internal business processes. A ransomware incident affecting a firm of this size therefore carries potential consequences not only for the company itself but for the many individuals whose details may reside in its systems. Public detail on OMINT’s precise business lines is not expanded in the breach reporting, yet the revenue figure alone indicates an operation large enough that any successful data theft would be consequential.

The information in question

The only data category named in the available facts is “internal files exfiltrated in ransomware attack.” No further breakdown—customer lists, employee records, medical information, financial documents or intellectual property—has been disclosed. Organisations of OMINT’s size and sector routinely store a mixture of personally identifiable information, contractual material, operational documents and, depending on the industry, sensitive health or financial data. Because the exact contents remain unconfirmed, it is not possible to state with certainty which categories were taken. The group’s claim of internal-file exfiltration is the sole public assertion; independent verification of the files or their sensitivity has not been published.

Why it matters

For individuals whose data may have been among the internal files, the practical risks include identity theft, targeted phishing, or misuse of personal details if the material later circulates. Even when the precise data types are unknown, any large-scale exfiltration from a revenue-generating organisation of this magnitude raises the possibility that contact information, account identifiers or other personal attributes could surface. For OMINT itself, the incident carries operational, regulatory and reputational costs: restoration of systems, potential notification obligations, and the need to assess whether customer or employee trust has been damaged. Because the number of people affected is unknown and the full data inventory is undisclosed, the true scale of downstream harm cannot yet be measured. The episode nevertheless illustrates how ransomware claims, even when details are sparse, create lasting uncertainty for both the organisation and anyone whose information it holds.

Were you affected?

If you have a past or present relationship with OMINT—as a customer, employee or partner—treat the possibility of exposure seriously until more information emerges. Monitor financial and medical accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to phishing messages that reference the organisation. Consider placing fraud alerts with credit bureaus if you believe sensitive identifiers may have been involved. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official statements from OMINT, if and when they are issued, remain the most reliable source for confirmation of impact.

AICompiled with AI assistance from public sources and published under our editorial standards.