wrm.org Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People connected to wrm.org — staff, partners, supporters or anyone whose details sit in its systems — now face the practical question of whether their information has left the organisation’s control. On 30 March 2025 the ransomware group known as safepay listed wrm.org on its leak site, claiming it had stolen internal files during a ransomware attack. The number of people affected remains unknown, and public detail about exactly what was taken is limited. For those whose data may be involved, the immediate stakes are straightforward: the possibility of unwanted contact, misuse of personal or organisational information, and the need to watch for follow-on fraud or phishing that could exploit any exposed material.

This article sets out only what has been reported, places the claim in the context of how safepay operates, and explains the real-world risks without speculation.

Breaking down the breach

According to the available record, wrm.org was listed by the safepay ransomware group on 30 March 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No confirmed figure for the number of people affected has been published, and the precise method of initial access, the duration of any intrusion, and the full volume of data taken have not been disclosed in public reporting. The listing itself is an unverified claim by the threat actor; independent confirmation of the full extent of the incident has not been provided in the facts available. What is stated is that internal files were removed from the organisation’s systems during the attack.

Inside safepay

Safepay is a ransomware operation that has been observed conducting double-extortion attacks: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups in this category, it maintains a leak site on which it names victims and, in some cases, posts samples or larger archives of stolen material. Public reporting on safepay’s activity has described typical tactics that include phishing or exploitation of exposed services for initial access, followed by lateral movement, data staging and exfiltration before encryption. The group’s listings are claims made by the actors themselves; they do not automatically constitute independent verification that every named organisation was fully compromised or that every claimed file set is authentic. In the case of wrm.org, the facts record only that the organisation appeared on the group’s site with the assertion that internal files had been exfiltrated.

wrm.org and its sector

wrm.org is the online presence of an organisation operating in the environmental and civil-society space, focused on issues connected to forests, land use and related advocacy. Organisations of this type routinely hold internal operational documents, correspondence, research materials, contact lists for partners and supporters, and administrative records. Because such groups often work across borders and with communities that may be vulnerable to pressure or surveillance, a breach can carry consequences beyond ordinary commercial data loss. The listing by a ransomware group therefore raises concerns not only about operational disruption but also about the potential exposure of sensitive organisational and personal information that could be misused by third parties.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, categories of personal data, or specific document titles has been disclosed. Organisations working in advocacy and environmental research typically maintain staff and volunteer records, donor or supporter contact details, project documentation, internal communications and financial or administrative files. Whether any of those categories were among the material claimed by safepay remains unconfirmed. Readers should treat the exact contents of the stolen data as unknown until the organisation or independent investigators provide verified detail.

The real-world impact

For individuals whose information may have been among the internal files, the concrete risks include targeted phishing that references genuine organisational details, attempts at identity misuse if personal identifiers were present, and unwanted contact from parties who obtain the data. For the organisation itself, the impact can include operational interruption, the cost of investigation and recovery, potential regulatory notification duties depending on jurisdiction, and erosion of trust among partners and supporters. Because the number of people affected is unknown and the precise data types remain undisclosed, the scale of these risks cannot yet be quantified. Even limited internal files can enable convincing social-engineering attacks, so caution is warranted regardless of the final volume.

Were you affected?

If you have had any relationship with wrm.org — as staff, volunteer, partner, donor or correspondent — treat the possibility of exposure seriously until more information emerges. Change passwords associated with any accounts that used the same credentials as organisational systems, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. Be sceptical of unexpected messages that claim to come from the organisation or that reference internal matters. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official updates from wrm.org, if and when they are issued, should be regarded as the primary source for confirmation of what was taken and who may be affected.

AICompiled with AI assistance from public sources and published under our editorial standards.