Safeware Data Breach

Safeware, a technology company based in the United States, has been listed as a victim on The Gentlemen ransomware group’s dark web portal. The listing, identified through SOCRadar’s Dark Web Monitoring service, was published on August 13, 2026. Safeware operates in the technology sector, providing insurance and protection services for electronics and personal tech products. The company handles customer data across consumer-facing web platforms, which increases the potential impact of a compromise on both corporate and customer records. In the 60 days prior to this listing, The Gentlemen had claimed 193 other victims. The group has demonstrated a strong targeting pattern in the Manufacturing, Technology, and general business sectors. Geographically, its victims are primarily located in the United States, Germany, and France. Recent The Gentlemen victims with a similar profile to Safeware, such as US-based technology or consumer-services companies, include Phase Technologies, aZaaS, Control Concepts Technology, and Promatrix. The Gentlemen remains a highly active threat actor, and Safeware represents one of many US technology sector targets the group has pursued.

SOCRadar’s stealer-log telemetry revealed a significant exposure for the safewareinc.com domain. The query returned 24 records across various categories, including 4 employee credentials on organization-controlled endpoints, 9 records linked to external or customer accounts on Safeware’s web infrastructure, and 4 corporate-user credentials on third-party services. Notable findings include an internal secondary account-provisioning endpoint accessed by both a corporate user and multiple external usernames, as well as a LogMeIn remote-access instance accessed by a corporate user on two occasions in 2025 and 2026. This pattern suggests a compromised employee workstation with persistent remote access tool usage. The overall data profile is classified as Mixed. The log and insert dates span from October 2025 through August 2026, indicating a prolonged exposure window without apparent remediation. For ransomware groups like The Gentlemen, infostealer-harvested credentials are a known initial access vector. Operators or initial access brokers acquire fresh logs from underground marketplaces, validate the corporate credentials, and then use them to access systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log evidence does not definitively confirm that these specific credentials were used by The Gentlemen, the presence of remote-access tool credentials alongside internal provisioning endpoint access is consistent with the lateral movement phase that often precedes ransomware deployment. Therefore, the LogMeIn-linked corporate user account should be treated as a high-priority target for credential rotation.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.