rlc.es Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The listing of rlc.es by the safepay ransomware group on 14 January 2026 adds one more entry to the steady stream of claims appearing on data-leak sites operated by ransomware operators. Public information currently consists of the group’s assertion that it obtained internal files from the Spanish company and the absence of any confirmed count of affected individuals or verified publication of the material.

Such listings have become a routine feature of the threat landscape, where groups combine encryption of systems with the removal of data to create leverage. The incident at rlc.es is notable primarily because the organisation handles freight and logistics, a sector whose records often contain details about shipments, clients and operational partners.

What happened

According to the available facts, safepay listed rlc.es on its leak site and stated that internal files had been exfiltrated during a ransomware attack. No date of the intrusion itself has been disclosed, nor has any figure for the number of people affected or the volume of data involved. The company has not issued a public statement confirming or denying the claim in the information provided.

Who is safepay?

Safepay is a ransomware group that has appeared in public reporting since 2024. Like several other operators, it typically deploys ransomware that both disrupts systems and copies data before encryption. The group maintains a leak site where it lists organisations it claims to have targeted, using the listings to pressure victims into payment. Public records show the group has claimed activity against entities in multiple countries and sectors, though independent verification of each listing is often limited.

rlc.es and its sector

RLC Transportes operates under the legal entity Rau Load Cargo, S.L. and is based in El Puig, Spain. It functions as a logistics and freight-transport company, moving goods for commercial clients. Organisations of this type routinely maintain records that include customer contracts, shipment documentation, vehicle and driver information, and internal communications. A breach affecting such records can expose details that extend beyond the company itself to its clients and supply-chain partners.

The information in question

The facts state that internal files were exfiltrated. No further breakdown of file categories or data fields has been released. Organisations in the logistics sector commonly store names, addresses, contact details, shipment identifiers and financial references; however, whether any of these specific elements are present in the material claimed by safepay remains unconfirmed.

Why it matters

Exposure of internal logistics files can reveal patterns of movement, client relationships and operational procedures that are normally kept confidential. For individuals whose information appears in such records, the main risks are misuse of contact details or shipment information for targeted fraud or social-engineering attempts. For the company, the incident adds operational disruption and the need to assess whether any regulatory notification obligations arise under Spanish or EU data-protection rules.

Were you affected?

At present the number of individuals whose data may be involved is unknown. Anyone who has conducted business with RLC Transportes or Rau Load Cargo can monitor their email accounts for unusual activity and consider placing fraud alerts with credit agencies if financial details were shared. Readers may also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.