E.A. Groep Data Breach

E.A. Groep, a Dutch entity operating in the agri-food and career services sectors, was identified on September 28, 2026, as a claimed victim of the Safepay ransomware group. This incident aligns with Safepay’s ongoing campaign targeting European agri-food companies, as observed through SOCRadar’s Dark Web Monitoring. The company’s operational base in the Netherlands places it within the geographical focus of Safepay’s recent activities. E.A. Groep’s organizational structure, encompassing multiple specialized business units, may present a broader attack surface and more complex IT governance compared to single-entity organizations, potentially making it an attractive target. Safepay has reported a significant increase in activity, claiming 40 victims in the preceding 60 days. The Agriculture and Food Production sector is identified as one of their three primary targets. While the United States, Switzerland, and Spain are frequently cited as victim countries, the group actively targets European entities beyond these core locations. E.A. Groep’s listing is consistent with this pattern of broad European targeting. The group’s recent activity includes similar listings for other agri-food companies such as Gayafores, Lagege Pesca, Granja Rinya, and Multiaqua, underscoring a deliberate focus on this industry. Strategic Context: Agri-Food as a Target Safepay’s consistent targeting of the European agri-food sector highlights a strategic pattern, with E.A. Groep being one of several listed victims in this domain within a recent 60-day period. The inclusion of companies like Gayafores, Lagege Pesca, Granja Rinya, and Multiaqua further solidifies this trend, suggesting a deliberate campaign against this industry. E.A. Groep’s multifaceted structure, integrating various specialized business units, could lead to a more extensive credential landscape and intricate IT management, potentially increasing its vulnerability. This sector-wide targeting by Safepay serves as a significant threat signal for European agricultural organizations.

SOCRadar’s investigation involved querying the domain eagroep[.]com against its stealer-log dataset. The query returned no records. It is important to note that this result does not confirm the absence of compromise, as personal aliases and credentials accessed via third-party platforms or other corporate domains remain outside the scope of this specific query. Therefore, the absence of stealer-log records for eagroep[.]com provides no definitive baseline and suggests that expanded monitoring is warranted. Given the pattern of Safepay targeting the agri-food sector, especially in Europe, and E.A. Groep’s operational context, continuous dark web monitoring and proactive credential hygiene practices are strongly recommended. Organizations within this sector, particularly those with complex structures, should consider this a signal for enhanced security measures. Decision for Security Leadership The consistent targeting of the European agri-food sector by Safepay should be interpreted as a significant threat indicator. Organizations operating within this industry, especially those with diversified business units, are advised to view this as a sector-wide alert. Recommended near-term actions include conducting thorough internal credential audits and performing comprehensive reviews of third-party access.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.