THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

SAFEPAY Lists Czech Retailer sumperk.cz on Ransomware Tracker

On September 28, 2026, the ransomware group SAFEPAY recorded the Czech e-commerce retailer sumperk.cz on its public leak site. The listing places the organization, which operates in the retail and e-commerce sector with an estimated 51 to 100 employees, on an attacker-side tracker. As of this writing, sumperk.cz has not disclosed a breach or confirmed any data compromise.

Key takeaways

• SAFEPAY recorded sumperk.cz on its leak site on September 28, 2026.
• The organization operates in retail and e-commerce in Czechia with 51-100 employees.
• No breach has been publicly disclosed by sumperk.cz as of this writing.
• A listing is strong signal but not a confirmed data compromise.

What We Know

• The organization listed is sumperk.cz, a domain-based entity operating in Czechia.
• The ransomware group responsible for the listing is SAFEPAY.
• The listing was recorded on September 28, 2026.
• The sector is retail and e-commerce.
• Company size is estimated at 51 to 100 employees.
• Disclosure status: not disclosed yet.

About SAFEPAY

SAFEPAY is a ransomware group that maintains a public tracker where it lists organizations it claims to have compromised. A listing on such a tracker is a strong indicator of a ransomware incident but does not by itself confirm that data was exfiltrated or that systems were encrypted. Intel128 records these listings as they appear and tracks disclosure status over time.

What This Means for sumperk.cz

A ransomware listing carries several implications for the organization and its customers:

• Reputational exposure. Public listings draw attention from journalists, security researchers, and customers. Even without a confirmed breach, the association can erode trust.
• Regulatory risk. Under the EU General Data Protection Regulation, organizations handling personal data of EU residents face obligations to assess and report breaches within 72 hours of becoming aware of them. A listing raises the question of whether such obligations have been triggered.
• Customer impact. E-commerce operations handle payment details, addresses, and purchase histories. If data was compromised, customers may face phishing or fraud attempts in the coming weeks.

What We Do Not Know

Intel128 does not have confirmed information on the following:

• Whether data was actually exfiltrated from sumperk.cz systems.
• The volume or type of data involved.
• Whether systems were encrypted or held for ransom.
• The initial access vector used by SAFEPAY.
• Whether any ransom was paid.

These details may emerge if the organization issues a public statement or if SAFEPAY publishes additional material on its tracker.

Recommended Actions

Organizations in the retail and e-commerce sector, particularly those operating in Czechia or the broader EU market, should consider the following steps:

• Review vendor and partner lists for any connection to sumperk.cz.
• Monitor for unusual login activity or credential-stuffing attempts that may follow a public listing.
• Confirm that incident response plans account for ransomware scenarios, including communication templates and regulatory reporting timelines.
• Ensure that customer-facing teams are prepared to handle inquiries if the listing gains media attention.

Intel128 will update this entry if the disclosure status changes or if additional verified information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.