Ransomware group SafePay has listed Australian retirement living provider Prospect Hill Camberwell on its dark web leak site, adding another Australian organisation to the group’s growing list of alleged victims.
The listing represents the second Australian retirement-related organisation to be targeted by ransomware groups in the past month, highlighting the continued exposure of the aged care and retirement living sector to cyber extortion activity.
While the appearance of an organisation on a ransomware leak site does not independently confirm the extent or legitimacy of a compromise, these listings typically indicate that the threat actor is attempting to pressure the victim into negotiations by threatening to publish allegedly stolen information.
For retirement and aged care providers, a successful cyber incident can have consequences beyond financial and operational disruption, potentially exposing sensitive personal information belonging to residents, employees and their families.
About SafePay
SafePay is an established ransomware operation that has remained active globally since emerging in August 2024. A joint cybersecurity advisory published on 20 October 2026 assessed that the group had compromised at least 600 organisations since its emergence.
Recent reporting has associated SafePay with alleged attacks against a range of international organisations, including Belgian industrial-equipment company DEOM S.A., Goldencrops Corporation, Rood Trucking Company and Universidad Autónoma de Aguascalientes.
The group targets a broad range of industries, including critical infrastructure, manufacturing, transportation, healthcare, education, finance, retail and professional services across North America, Europe, Asia-Pacific and Latin America.
Its reported tactics include exploiting exposed or stolen credentials, brute-force attacks, phishing, compromising VPNs and internet-facing edge devices, and gaining access through Remote Desktop Protocol (RDP). Following initial access, operations can involve privilege escalation, credential theft, network discovery, lateral movement, data staging, exfiltration and ultimately ransomware deployment.
Associated vulnerabilities include:
- CVE-2020-3259
- CVE-2023-20269
- CVE-2023-27532
- CVE-2024-40711
- CVE-2024-40766
Two notable MITRE ATT&CK techniques associated with the group’s operations include T1005 (Data from Local System) and T1486 (Data Encrypted for Impact).
SafePay’s sustained victim volume and reported centralised operating model distinguish it from many shorter-lived ransomware operations. Its continued activity presents significant data exposure and operational disruption risks, particularly for organisations relying on externally accessible infrastructure and services.
The addition of another Australian retirement-related organisation to ransomware leak sites is a reminder that aged care and retirement living providers hold substantial quantities of sensitive personal information and should be considered attractive targets for financially motivated threat actors.
