THREAT WATCH · September 30, 2026 · RANSOMWARE LISTING

SAFEPAY Lists Belgian Domain assist2enjoy.be on Leak Site

On September 30, 2026, the ransomware group SAFEPAY recorded the domain assist2enjoy.be on its public leak site. The listing places a Belgian organization under the group's extortion pipeline. No public statement has been issued by the affected party as of this writing. This post summarizes what Intel128 has verified from its own tracking, what remains unknown, and what steps organizations should consider in response.

Key takeaways

• SAFEPAY recorded assist2enjoy.be on its leak site on September 30, 2026.
• The listing is associated with a Belgian entity; sector and size are unknown.
• No public disclosure has been made by the organization.
• A leak-site listing is strong signal of targeting, not confirmed breach.

What Intel128 has confirmed

• The domain assist2enjoy.be was recorded on the SAFEPAY leak site on September 30, 2026.
• The listing is associated with an entity based in Belgium.
• SAFEPAY is the ransomware group responsible for publishing the listing.
• No public disclosure has been made by the organization itself at the time of this post.

What is not yet known

• The sector in which the organization operates has not been identified by Intel128.
• The size of the organization is unknown.
• It is unclear whether data was actually exfiltrated or whether the listing is a bluff intended to pressure a victim into paying.
• No details about the nature or volume of any claimed data have been published by SAFEPAY.
• It is not known whether negotiations between the organization and the group are ongoing.

About SAFEPAY

SAFEPAY is a ransomware group that operates a public leak site where it lists victims who have not paid a ransom or who have refused to engage in negotiations. Listings on such sites are used as pressure tactics to force payment. The group has been active in targeting organizations across multiple regions and sectors. Intel128 continues to monitor SAFEPAY activity and will update this post if new information becomes available.

What organizations should do

• Review whether your own domain or any affiliated domains appear on known ransomware leak sites.
• Confirm that your incident response plan is current, tested, and accessible to the right personnel.
• Ensure that backups are isolated from production networks and can be restored without dependency on the attacker.
• Monitor for secondary effects such as credential reuse, phishing campaigns, or social engineering attempts that may follow a public leak.
• Brief executive leadership on the current threat landscape so that decisions about disclosure and response are made with full context.

Intel128 assessment

A listing on a ransomware leak site is strong signal that an organization was targeted and that attackers claim to hold data. It is not, by itself, proof of a confirmed breach. The absence of a public statement from assist2enjoy.be means the situation remains unconfirmed from the victim side. Intel128 will continue tracking this case and will publish updates if the organization discloses details or if SAFEPAY publishes additional information about the listing.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.