THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

Mexican Manufacturing Firm Listed on SAFEPAY Ransomware Tracker

A manufacturing and engineering company based in Mexico has been recorded on the SAFEPAY ransomware tracker. The listing was observed on September 28, 2026. The organization operates in the 51 to 100 employee range. No data has been publicly disclosed by the group at this time.

Key takeaways

• Auromex appears on a SAFEPAY ransomware listing dated September 28, 2026
• No stolen data has been published by the group so far
• The company is a mid-sized manufacturing and engineering firm based in Mexico
• A listing is a targeting signal, not a confirmed breach

What We Know

• The organization appears on a SAFEPAY-affiliated ransomware listing page.
• The listing date is September 28, 2026.
• The company is based in Mexico and operates in the manufacturing and engineering sector.
• Company size is estimated at 51 to 100 employees.
• No stolen data has been published or disclosed by the group so far.

About SAFEPAY

SAFEPAY is a ransomware group that operates a public leak site where it posts the names and domains of organizations it claims to have compromised. The group uses a double-extortion model, meaning it encrypts data and threatens to publish stolen files unless a ransom is paid. Listings on the tracker do not confirm that data was exfiltrated or that systems were successfully encrypted. They indicate that the group has added the organization to its public pressure campaign.

What This Means for the Organization

A listing on a ransomware tracker is a strong signal that the organization is being targeted or has been targeted. It does not confirm a breach. However, it warrants immediate internal review. Security teams should check for indicators of compromise, review recent access logs, and confirm whether any unusual activity aligns with the listing date.

Recommended Actions

• Verify internally. Confirm whether any incident response activity or suspicious behavior was observed around late September 2026.
• Monitor for disclosure. Track whether the group publishes data related to this listing in the coming days or weeks.
• Review exposure. Assess whether the organization has internet-facing systems, remote access tools, or unpatched software that could have been exploited.
• Engage response partners. If any signs of compromise are found, involve incident response specialists and legal counsel promptly.
• Communicate with stakeholders. If the listing is confirmed to relate to the organization, prepare a communication plan for customers, partners, and regulators.

Context for Decision Makers

Manufacturing and engineering firms are frequent targets of ransomware groups because they often hold sensitive intellectual property, supplier data, and operational technology that can be disrupted. Mid-sized companies in the 51 to 100 employee range are particularly attractive to attackers because they may lack the dedicated security teams that larger enterprises maintain, while still holding valuable data.

SAFEPAY has been active in targeting organizations across multiple sectors and geographies. Mexico-based companies have appeared on its tracker alongside firms from other countries. The group tends to list organizations and then wait for a response before escalating to data publication.

Bottom Line

This listing is a signal, not a verdict. The organization should treat it as a trigger for internal investigation and heightened monitoring. If no compromise is found, the listing may reflect an attempted attack that was detected or a false claim by the group. Either way, the appropriate response is to verify, monitor, and prepare.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.