On August 03, 2026, the ransomware group Safepay listed simonrack.com on its leak site, claiming the Spanish manufacturer of metal shelving systems had been hit by a ransomware attack in which internal files were exfiltrated. The company, headquartered in Alfamén, Zaragoza, and operating since 1964, has not publicly confirmed the claim as of this writing. This means the claims remain unverified by any official company notification, regulator filing, or government disclosure.
Watch simonrack.com
Get alerted the next time simonrack.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about simonrack.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Leak-Site Claims
The Safepay leak-site posting states that internal files were exfiltrated during a ransomware attack. The listing does not specify the volume of data taken, the exact types of records involved, or any ransom demand. According to the post, the company was given a deadline to negotiate before additional material would be published. Because the only primary source is the threat actor’s own leak site (mirrored on ransomware.live), these details constitute an unconfirmed claim rather than an established breach. Simon Rack has issued no public statement acknowledging the incident.
Why This Matters for You and Your Family
When a company that has done business with customers, suppliers, or employees is listed in this way, personal information tied to those relationships can end up in criminal hands. Even if the leak-site listing does not detail customer records, employee data, or financial documents, the exposure of internal files often includes spreadsheets, contracts, invoices, or email archives that contain names, addresses, phone numbers, email addresses, and sometimes national identification numbers. Any such data increases the chance that you or your family could face targeted phishing, identity theft, or follow-on fraud. The fact that the victim is a long-established European manufacturer does not limit the risk; once data leaves the company’s control, it can be traded or used anywhere.
Doxxing and Identity-Chain Risks
Leaked internal files frequently create doxxing chains. A single email address or phone number found in a supplier spreadsheet can be cross-referenced with breached gaming accounts, social-media handles, or family-member records. Children’s usernames or school-related emails that appear in parent-company correspondence are especially valuable to attackers because they often share the same home address. This linkage turns one corporate incident into persistent personal exposure. Credential reuse across work, personal, and gaming accounts makes the cascade faster and more damaging.