Safepay ransomware group claims the hack of professional video surveillance provider Xortec

According to Security Affairs, the Safepay ransomware group claims the hack of Xortec, a German video surveillance provider, and has added the company to its data leak site with a payment deadline of 27 October 2025. Xortec GmbH, based in Frankfurt with offices across Germany, is described as a value-added distributor and systems integrator specialising in video surveillance, IP networking and security solutions, providing cameras, NVRs, access control, cabling and consulting for enterprise and installer clients.

Acquired by Beyond Capital Partners in 2021, Xortec is portrayed as a fast-growing B2B firm with several dozen employees and an annual revenue of over €7.5 million, driven by large installation projects. The piece notes that the hack could have wide-reaching effects due to Xortec’s role in the security supply chain, potentially enabling backdoors in hardware or software used by installers and exposing client data, surveillance layouts and shipment records.

It also highlights that SafePay is a fast-growing ransomware group active since late 2024, employing double extortion and targeting sectors globally, with the group described as operating rapidly within 24 hours of gaining access and avoiding Russian systems.