THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

SAFEPAY Lists Belgium Agriculture Firm eagroep.com

On September 28, 2026, the domain eagroep.com appeared on a ransomware disclosure page operated by the SAFEPAY group. The listing identifies a Belgium-based organization working in the Agriculture and Food sector. Company size is recorded as 51 to 100 employees. As of this writing, the organization has not publicly acknowledged the listing or confirmed any incident. A tracker entry is strong signal of a possible compromise, but it does not by itself confirm a breach. Intel128 records this as a new listing and will update if the situation develops.

Key takeaways

• SAFEPAY recorded eagroep.com on September 28, 2026, placing a Belgium Agriculture and Food company on its disclosure page.
• The organization has not publicly acknowledged the listing. No data samples or victim statements are attached.
• Small-to-mid market firms in Agriculture and Food are increasingly targeted by ransomware groups seeking operational data.

What the listing shows

• The SAFEPAY ransomware group recorded eagroep.com on its disclosure page on September 28, 2026.
• The domain is associated with a Belgium-based company operating in the Agriculture and Food sector.
• Company size is listed as 51 to 100 employees, placing it in the small-to-mid market range.
• No data samples, victim statements, or countdown timers have been published alongside the entry at this time.
• The disclosure status is marked as not disclosed, meaning the organization has not issued a public statement.

Who is affected

• The organization behind eagroep.com is the primary subject of this listing.
• No parent company, subsidiary, or partner is named in the tracker entry.
• Belgium's Agriculture and Food sector includes supply-chain operators, processors, distributors, and cooperative networks. Any of these roles could apply here, but the tracker does not specify which.
• Downstream partners in logistics, retail, or food safety compliance may also face indirect exposure if trust boundaries between organizations are weak.

Why this matters

• SAFEPAY is an active ransomware operation that publishes victim domains to pressure organizations into paying a ransom.
• A listing on an attacker-side tracker typically follows an encryption event or a data-theft claim, though the group has not confirmed which applies in this case.
• Small-to-mid market firms in the Agriculture and Food sector are increasingly targeted because they often lack dedicated security teams and may hold operational data valuable to downstream partners.
• The absence of a public statement from the organization means the situation remains unconfirmed and potentially evolving. Intel128 will monitor for updates.

Recommended actions

• Verify internally. If your organization has a relationship with eagroep.com, check whether any shared systems, credentials, or data flows could be affected.
• Monitor for follow-up. SAFEPAY may publish additional details, data samples, or a countdown timer in the coming days. A change in disclosure status would be a meaningful signal.
• Review supply-chain exposure. Agriculture and Food operators often connect to logistics, retail, and government systems. A single listing can cascade if trust boundaries are weak.
• Update incident-response plans. Confirm that your team knows how to respond to a third-party ransomware listing that names a vendor or partner.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.