deom.be Data Breach

Safepay ransomware listed deom[.]be, a Belgium-based organization, on its dark web leak portal on November 2, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Industry classification for the organization was not available in the public listing data, leaving the victim’s sector undetermined. The listing is geographically notable: Belgium is an infrequent target for Safepay, and the entry extends the group’s European reach beyond its established presence in Germany and Switzerland. Safepay has claimed 55 victims over the past 60 days, with activity spanning the Other, Manufacturing, and Technology sectors. The group’s geographic concentration sits in the United States, Germany, and Switzerland, and its recent listings include Layam, iKHASAS Sdn. Bhd., Anwo, and Wolf & Sosofsky. Within that pattern, the deom[.]be listing reflects the group’s continued willingness to extend into Western European markets outside its primary geographies, positioning the new Belgian victim alongside, rather than within, the countries where Safepay activity has been most concentrated.

SOCRadar’s stealer-log query for deom[.]be returned no records in this period. The result is drawn from a bounded, paginated dataset, meaning the check reflects a limited sample of stealer-log telemetry rather than an exhaustive view of all credential feeds. Read against the Safepay leak-site listing, the empty result neither corroborates nor rules out the claimed compromise; it is a bounded observation about a single dataset over a single period, not a definitive assessment of the organization’s credential exposure. Several limitations attach to this finding. Credentials associated with deom[.]be may exist under alternate domain formats, which a direct query against the primary domain would not surface, and relevant records may sit in feeds not captured in this slice of data. A lack of positive signal is therefore not a clean bill of health, and the absence of stealer-log entries does not confirm that the organization is unaffected. Given these constraints, continued dark web and stealer-log monitoring, together with proactive credential checks across alternate domain formats associated with deom[.]be, remain the appropriate follow-up steps.