usdaw.org.uk Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
usdaw.org.uk was listed today by the safepay ransomware group, which claims to have exfiltrated internal files from the site. Individuals who may have interacted with the organisation should review their accounts and consider protective steps.
The listing of usdaw.org.uk by the safepay ransomware group on 29 December 2025 raises questions for members and staff of one of the United Kingdom’s largest trade unions. Internal files were reportedly taken during a ransomware incident, yet the number of individuals affected and the precise contents of those files remain undisclosed.
What happened
Usdaw.org.uk appeared on a leak site associated with the safepay group on 29 December 2025. The group states that internal files were exfiltrated during a ransomware attack. No confirmed count of affected individuals has been published, and details on the timing or method of the intrusion have not been released by the organisation.
The group behind it: safepay
Safepay is a ransomware operation that publicly lists victim organisations on its leak site after claiming to have stolen data. The group typically follows a double-extortion pattern: it seeks payment to prevent publication of files and sometimes to supply a decryptor. Its listings constitute claims by the actor; independent confirmation of any specific incident rests with the targeted organisation or law-enforcement findings.
usdaw.org.uk and its sector
Usdaw, the Union of Shop, Distributive and Allied Workers, represents hundreds of thousands of workers in retail, distribution and allied industries across the United Kingdom. Trade unions routinely hold records that include members’ names, addresses, employment details and, in some cases, financial or health-related information required for representation and services.
What was likely exposed
The only detail released states that internal files were exfiltrated. The exact categories of data contained in those files have not been confirmed. Organisations of this type commonly store member contact information, employment histories and administrative correspondence, but whether any of these categories appear in the claimed exfiltration cannot be verified from public information.
The real-world impact
Exposure of internal union files could lead to misuse of personal contact details or employment records for phishing or targeted fraud. For the organisation, the incident may complicate ongoing representation work and require additional resources for investigation and member notification. The absence of a confirmed data inventory leaves the scale of these risks undetermined.
Were you affected?
Usdaw has not published a confirmed list of impacted individuals. Members and staff can contact the union directly for guidance on any internal review. Practical steps include:
- Monitor bank and email accounts for unusual activity.
- Enable multi-factor authentication on all union-related and financial services.
- Run a free exposure scan of your email address against known breach datasets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
knightgroup.co.uk Listed by safepay Ransomware Groupwadzeck-stiftung.de Listed by safepay Ransomware Groupheatcel.co.uk Listed by safepay Ransomware Groupmassfd.org Listed by safepay Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the usdaw.org.uk Listed by safepay Ransomware Group →
Publicly posted by safepay — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.