onnicar.it Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 19 November 2024 the Italian organisation onnicar.it appeared on the leak site of the safepay ransomware group. The group claims to have carried out a ransomware attack that involved the exfiltration of internal files. The number of people affected is unknown, and independent confirmation of the full scope remains limited.

Public reporting so far rests on the listing itself and the accompanying claim of a 127 GB archive of internal material. That claim has not been independently verified, yet the listing alone is enough to raise practical questions for anyone who has dealt with the organisation.

What happened

According to the available record, safepay listed onnicar.it on 19 November 2024. The group asserts that it conducted a ransomware attack and removed internal files, packaging them as a ZIP archive said to total 127 GB. No further technical details—such as the initial access method, the exact date of intrusion, or whether encryption of production systems occurred—have been disclosed in the public summary. The number of individuals whose data may have been involved is also unreported. At present the incident is known only through the group’s own claim on its leak site.

Who is safepay?

Safepay is a ransomware operation that became active in 2024 and follows the now-common double-extortion model: data are stolen before systems are encrypted, and the threat of public release is used to pressure victims. The group maintains a dedicated leak site where it posts victim names, sample files and, in some cases, full archives once a ransom deadline passes. Like other contemporary ransomware crews, it typically targets mid-sized organisations across multiple sectors and regions, advertising stolen data volumes and occasional financial figures to increase leverage. Its listings are claims made by the operators themselves and should be treated as unverified until corroborated by the victim or independent investigators.

Who is onnicar.it?

onnicar.it is an Italian commercial organisation. Publicly available information places it among mid-sized businesses with reported annual revenue in the region of 23 million dollars—an figure that appears in the safepay listing and has not been independently confirmed in open sources. Organisations of this scale and sector ordinarily manage customer records, supplier contracts, financial documents, employee data and operational files. A breach of such material can affect both the company’s day-to-day operations and the privacy of individuals who have interacted with it as customers, partners or staff.

What data was at risk

The only concrete description supplied by the listing is that internal files were allegedly exfiltrated. No inventory of specific data categories—such as names, contact details, financial records or identity documents—has been released. The group further claims the stolen material amounts to a 127 GB ZIP archive and references the organisation’s revenue figure of 23.2 million dollars. Because the exact contents remain unconfirmed, the following points summarise what is known and what is not:

• Claimed volume: 127 GB of internal files packaged as a ZIP archive.
• Nature of material: described only as “internal files”; no further breakdown is public.
• People affected: number unknown.
• Revenue figure cited by the group: 23.2 million dollars (unverified).
• Independent verification of the archive’s contents: not yet available.

Organisations of this type typically hold customer and supplier information, contracts, accounting data and internal correspondence. Whether any of those categories were present in the claimed archive cannot be established from the current public record.

The real-world impact

For individuals, the principal risk is that personal or business contact details, contractual information or other records linked to onnicar.it could later appear in secondary leaks or be used for targeted phishing and social-engineering attempts. Because the precise data types remain undisclosed, the severity for any single person cannot yet be measured. For the organisation itself, the listing creates operational, legal and reputational pressure: systems may need forensic review, regulators may require notification, and customers or partners may seek reassurance. Until the archive is examined or the company issues a detailed statement, both the scale of exposure and the concrete harm remain estimates rather than established facts.

Were you affected?

If you have done business with onnicar.it, monitor financial and email accounts for unusual activity and treat unexpected messages that reference the company with caution. Change passwords for any accounts that reused credentials associated with the organisation, and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official statements from onnicar.it or Italian data-protection authorities, if and when they are issued, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.