{
 "Event": {
  "uuid": "555c9614-2fc1-5b9c-9a58-8d1170ae14cd",
  "info": "SafePay Ransomware Claims Air Liquide Korea",
  "date": "2026-08-25",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"ransomware\""
   },
   {
    "name": "misp-galaxy:country=\"south korea\""
   },
   {
    "name": "misp-galaxy:sector=\"manufacturing\""
   },
   {
    "name": "misp-galaxy:sector=\"chemicals\""
   },
   {
    "name": "misp-galaxy:sector=\"industrial gases\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/safepay-ransomware-claims-air-liquide-korea/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.ransomware.live/id/aW5kdXN0cnkuYWlybGlxdWlkZS5rckBzYWZlcGF5",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "The SafePay ransomware group listed industry.airliquide.kr, the Korean industrial-gases arm of Air Liquide, on its leak site on 25 August 2026. Air Liquide Korea supplies essential gases to major South Korean industries including semiconductor manufacturing; SafePay operates a double-extortion model and had claimed over 530 victims globally by August 2026.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}