smp.cat Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A private healthcare organization based in Catalonia, Spain, appears on a listing published by the ransomware group safepay. The entry, dated May 06, 2026, states that internal files were taken from smp.cat during a ransomware incident. No information has been released on the number of people affected or on any subsequent confirmation of the claims. The scale and exact timing of the intrusion remain undisclosed. Public records show only the group’s assertion that files were removed; no independent verification of the volume, content, or method of access has been made available.

Breaking down the breach

The incident is known solely through safepay’s leak-site posting. The group claims that internal files were exfiltrated, yet provides no further technical detail in the public listing. The date the files were taken, the duration of any unauthorized access, and whether encryption was also deployed are not stated. No statement from smp.cat has been issued, and the number of records or individuals involved is listed as unknown.

Inside safepay

Safepay is a ransomware operation that publishes victim names on a dedicated leak site when ransom demands are not met. The group follows a double-extortion pattern in which data are first copied and later threatened with disclosure. Public reporting on the actor has documented similar listings against organizations in multiple countries, though each claim requires separate verification.

About smp.cat

Smp.cat is a private healthcare provider founded in 1993 and active in the Hospitals & Physicians Clinics sector in Catalonia, Spain. Organizations of this type maintain patient records, appointment systems, billing information, and internal administrative files. A breach at such an entity therefore touches data that are both personal and regulated under European health-information rules.

What data was at risk

The only data category named in the listing is “internal files exfiltrated in ransomware attack.” No inventory of specific record types, file counts, or patient identifiers has been released. Healthcare providers routinely hold clinical notes, diagnostic results, insurance details, and staff records; whether any of these categories were among the claimed files cannot be confirmed from the available information.

Why it matters

Exposure of internal healthcare files can affect patient privacy and may create long-term risks of identity misuse or targeted fraud. For the organization, the incident raises questions about regulatory reporting obligations under Spanish and EU data-protection law. Until the contents are verified, the practical impact on individuals remains difficult to quantify.

If your data was in this claimed breach

Monitor official statements from smp.cat and any notifications required by data-protection authorities. Change passwords for any accounts linked to the organization and enable multi-factor authentication where available. Individuals can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.