tokyocivil.co.jp

tokyocivil.co.jp was compromised in a ransomware attack attributed to safepay in June 2026. The organization, operating in the Construction sector in Japan, was added to the group's data leak site as part of an extortion campaign.

safepay operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Established in 2020, the company specializes in public infrastructure and civil engineering projects, serving primarily the Tokyo metropolitan area and …