Ransom! ggw.net

The safepay threat actor targeted gg.net, an Oakville-based accounting firm, with ransomware causing significant data disruption. The attack primarily impacted Canada.

Incident Details

  • Victim: ggw.net
  • Country: CA
  • Actor: safepay
  • Source: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/ggwnet/
  • Discovered: 2025-10-10 21:11:25.051549
  • Published: 2025-10-10 21:11:12.753942

Information

  • GGW.net is a ransomware victim.
  • The incident involved the actor Safepay.
  • Glenn Graydon Wright LLP, an accounting and advisory firm based in Oakville, Ontario, was affected.
  • The firm was founded in 1958 and offers assurance, tax, and other financial services.

Disclaimer: This post is based on public claims made by the ransomware group "safepay". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.

monitored by: ransomware.live