THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

Spanish Manufacturer Listed on SAFEPAY Ransomware Tracker

A manufacturing and engineering company based in Spain has been recorded on a ransomware leak tracker operated by the SAFEPAY group. The listing was published on September 28, 2026. The organization, identified by the domain cromados.com, appears on the tracker with a company size of 51 to 100 employees. No data has been disclosed publicly at the time of this entry. This listing is a strong signal of a potential ransomware incident but does not confirm that a breach occurred.

Key takeaways

• cromados.com recorded on SAFEPAY tracker on September 28, 2026
• Organization is a mid-sized manufacturer in Spain with 51-100 employees
• No data has been published yet; disclosure status remains unconfirmed
• Mid-sized engineering firms remain a priority target for ransomware groups

What is known

• The domain cromados.com was recorded on the SAFEPAY ransomware tracker on September 28, 2026.
• The organization is based in Spain and operates in the manufacturing and engineering sector.
• Company size is listed as 51 to 100 employees.
• No data has been published on the tracker as of this writing.
• The disclosure status is currently marked as not disclosed.

What this means

A listing on a ransomware tracker indicates that an attacker group claims to have obtained data from the organization and is threatening to publish it. This is not a confirmed breach. It is a signal that warrants immediate investigation by the affected company and its security team.

For organizations in the same sector or region, this listing serves as a reminder that ransomware groups actively target mid-sized manufacturers and engineering firms. These companies often hold intellectual property, design files, and operational data that attackers consider valuable. The mid-size range of 51 to 100 employees is particularly relevant because such organizations may have fewer dedicated security resources than larger enterprises while still holding data of interest to threat actors.

Recommended actions

• If you operate in the manufacturing or engineering sector in Spain, review your exposure to ransomware threats and confirm that your incident response plan is current.
• Verify that offline backups are in place and tested regularly.
• Monitor for signs of compromise, including unusual outbound traffic or unauthorized access to file shares.
• If you are the organization named in this listing, engage a qualified incident response firm immediately and do not assume the listing is false.
• Review vendor and third-party access paths that could be exploited to reach operational systems.

Context on SAFEPAY

SAFEPAY is a ransomware group that operates a public leak tracker where it lists victims and threatens to publish stolen data. The group has been active in targeting organizations across multiple sectors and geographies. A listing by SAFEPAY does not confirm that data was exfiltrated, but it does indicate that the group claims to have done so. Organizations listed by SAFEPAY may face pressure through direct contact or through the threat of public exposure.

Intel128 assessment

The listing of cromados.com on the SAFEPAY tracker is a verified observation from Intel128 monitoring. The disclosure status remains not disclosed yet, meaning the group has not published any data. This window is often when negotiation attempts occur. Organizations that receive contact from ransomware groups should treat the situation as urgent and seek professional guidance. Intel128 will update this entry if the disclosure status changes.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.