THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

SAFEPAY Lists Swiss Firm lfgholding.com on Ransomware Tracker

On September 28, 2026, Intel128 recorded the domain lfgholding.com on the SAFEPAY ransomware tracker. The organization is based in Switzerland and operates in the Other sector with a headcount of 0 to 50 employees. No public disclosure of a breach has been made by the company as of the time of this report. This entry will be updated if new information becomes available.

Key takeaways

• lfgholding.com was recorded on the SAFEPAY tracker on September 28, 2026
• The organization is a small Swiss firm with 0 to 50 employees
• No public disclosure of a breach has been made by the company
• A tracker listing is a strong signal but not a confirmed breach

What was recorded

• The domain lfgholding.com appeared on the SAFEPAY ransomware tracker on September 28, 2026.
• SAFEPAY is a ransomware group that publishes victim domains on its leak site as part of its double-extortion model.
• The listing indicates the group claims to hold data from this organization and may threaten to release it publicly.
• A listing is a strong indicator of compromise but does not independently confirm a breach.

About the organization

• lfgholding.com is registered in Switzerland.
• The company operates in the Other sector category, which means its primary business activity does not fall into a standard classification used by Intel128.
• Company size is estimated at 0 to 50 employees based on available records.
• No public statement or disclosure has been issued by the organization regarding this listing.
• The lack of disclosure is common in the early hours following a listing, as organizations often take time to investigate before making public statements.

What SAFEPAY listings mean

• SAFEPAY operates a leak site where it publishes domains of organizations it claims to have compromised.
• Listings typically include the domain name and sometimes additional details such as file counts, screenshots, or descriptions of stolen data.
• The presence of a domain on such a tracker is treated as a high-confidence signal of a ransomware incident.
• It is not a confirmed breach until the organization itself acknowledges it or independent verification occurs.
• Some listings may be removed later if the group fails to follow through or if the claim is found to be false.

Recommended actions for affected parties

• If you have a business relationship with lfgholding.com, review your data-sharing agreements and assess your exposure.
• Monitor for unusual activity in any shared systems, networks, or credentials.
• Check whether your own domain or email addresses appear in connection with this listing.
• Consider rotating credentials if you have shared access with the organization.
• Review your incident response plan for third-party breach scenarios and ensure your team knows the escalation path.

Context

• Switzerland has seen a growing number of ransomware listings in recent years, particularly targeting smaller firms that may lack dedicated security teams.
• Small organizations with fewer than 50 employees are often targeted because they tend to have fewer defensive controls and may be more likely to pay.
• SAFEPAY has been active in publishing victim domains across multiple sectors and geographies.
• Intel128 will update this entry if the organization issues a public statement or if additional details emerge from the listing.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.