SafePay Ransomware Claims Attack on Marine Biotech Firm HIQ Bio
The SafePay ransomware group has listed a US healthcare and marine biotechnology company on its dark-web site. The company has not confirmed any incident, and the claim cannot be independently verified.
Key points
- SafePay listed hiqbio.com on its dark-web leak site on 12 October 2026, according to monitoring service Ransomware.live.
- HIQ Bio is a US company that applies marine biotechnology to human health products, animal health, and aquaculture.
- HIQ Bio has not publicly confirmed any breach, and the claim could not be independently verified at publication time.
- Manufacturing is the most frequently targeted sector in SafePay's claimed victim list, though this listing falls under healthcare.
A ransomware group called SafePay has claimed responsibility for an attack on HIQ Bio, a US company that, according to the group's own post, applies marine biotechnology to human health products, animal health, and sustainable aquaculture. The listing appeared on SafePay's dark-web leak site on 12 October 2026 and was first observed by Ransomware.live.
Ransomware is malicious software that criminals use to lock a company's files and demand payment to restore access. Leak sites are pages on the dark web, a part of the internet requiring special software to reach, where ransomware groups name alleged victims to pressure them into paying before any data is published.
HIQ Bio has not publicly confirmed any incident. The claim is unverified.
How serious is SafePay as a group?
Active enough to warrant attention. This is the fourth healthcare-sector ransomware claim Threat Vectr has covered in less than two weeks, following our 9 October report on a listing targeting KC Pharmaceuticals. Manufacturing companies appear most often on SafePay's list, though the group ranges across industries.
The figures circulating about SafePay's victim count are drawn from leak-site monitoring services, not independently verified by Threat Vectr, and do not appear in SOURCE material for this story. Ransomware groups sometimes exaggerate the scale of an attack or post listings that are partly or entirely false, typically to create pressure on the target.
| Detail | Value |
|---|---|
| Listing date for HIQ Bio | 2026-10-12 |
| Country of listed company | United States |
| Sector | Healthcare |
| Listing observed by | Ransomware.live |
Should customers or staff be worried right now?
No confirmed breach means no confirmed data exposure. A listing like this is sometimes used by other criminals as a pretext for follow-on scams, so a few sensible steps now are worth taking rather than waiting.
Watch for phishing emails, fake messages designed to trick you into handing over passwords or clicking a harmful link, that reference this news. Criminals sometimes target people connected to a named company. Be skeptical of any phone call or email claiming to offer breach compensation or asking you to verify account details because of a reported incident. If you hold an account with HIQ Bio or a related service and you reuse that password elsewhere, change it on those other accounts now.
MFA, short for multi-factor authentication, meaning a second verification step beyond a password when you log in, such as a code sent to your phone, limits the damage even if login details were exposed. Enable it wherever the option exists.
There is nothing specific for the public to act on until HIQ Bio or an authority makes a formal statement. Watch the company's official channels for any update.
The description in the group's post is written by the attackers themselves to pressure the victim, not to inform the public accurately. Treat it accordingly.
