Short answer
CISA, the FBI and partner agencies published advisory AA26-293A on 20 October 2026. It says SafePay, active since August 2024, has hit at least 600 victims across critical infrastructure sectors and ranks among the most active ransomware groups in 2026.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | SafePay ransomware group (CISA advisory AA26-293A) |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by authorities |
| Sector | Critical infrastructure (multiple sectors) |
| Country | United States |
| Detected | 2024-08-01 |
| Disclosed | 2026-10-20 |
| People or records affected | At least 600 organizations across North America, South America, Europe and Australia, per CISA |
What data was exposed
- Files stolen before encryption and posted to the group's leak site when a victim does not pay
- Backups held on network-attached storage, which the group resets or deletes
- The advisory does not list specific data types, because victims differ
What the advisory says
On 20 October 2026 CISA and the FBI released joint cybersecurity advisory AA26-293A on the SafePay ransomware group, with the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and the UK National Crime Agency and North West Regional Organised Crime Unit. BleepingComputer reported it on 21 October.
CISA says SafePay emerged in August 2024, has hit at least 600 victims across critical infrastructure sectors, and is “among the most active ransomware groups in 2026.” Indicators in the advisory cover activity observed from November 2024 to August 2026. Ransom demands are typically a share of the victim’s revenue, paid in cryptocurrency.
This post is about a campaign, not one breached organization. The advisory does not name individual victims.
How SafePay gets in
According to the advisory, initial access comes from credential exposure and brute force, from VPN access using phished account profiles and IP addresses associated with Mullvad, and from automated scripts that exploit flaws in internet-exposed systems. CVEs listed include CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
What happens inside the network
CISA describes a living-off-the-land approach: admin rights added to existing or newly created accounts, PsExec and WinRM for remote commands, and share-hunting tools to find data. Security software is disabled before lateral movement. Data is compressed and sent out using tools such as WinSCP, RClone, FileZilla and Backblaze’s b2.exe, and in some cases OneDrive.
To block recovery, the group stops the Volume Shadow Copy Service and resets NAS devices that hold backups. Files are encrypted with a ChaCha20 and RSA scheme and receive a .SafePay extension. A note on the desktop points to a Tor chat portal, and representatives phone victims to apply pressure. Unpaid victims’ data is posted to a leak site.
Mitigations from CISA
The advisory recommends:
- Patch known exploited vulnerabilities, starting with edge devices.
- Require MFA for all services, and use identity and access management policies.
- Use 15 to 64 character passwords, stored in password managers, without reuse.
- Keep offline, encrypted, immutable backups in separate locations, and test restores.
- Segment networks, monitor with EDR, and audit accounts for unrecognized or inactive entries.
- Apply just-in-time admin access and disable command-line and scripting rights where possible.
If encryption has not yet occurred, isolate hosts, hunt for the intrusion and report it. If it has, follow CISA’s #StopRansomware checklist.
Why this matters for scams
Ransomware crews pair technical attacks with pressure calls and leak threats. Anyone who gets an unexpected call about “your stolen data” should verify through their own security team or the agencies named above. Be wary of third parties promising to decrypt files or scrub leaks for a fee.
See the data breach checklist and the guide to fake invoice and business email scams. Another recent campaign aimed at backup devices is covered in the Synology NAS ransomware campaign.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phone calls from people claiming to act on the group's behalf to pressure victims into paying.
- 'Recovery' firms that promise to decrypt files or delete leaked data for a fee, which can be scams or hidden ransom payments.
- Phishing emails that try to harvest VPN or email logins, which SafePay uses for initial access.
What to do if you are affected
- 01Require multifactor authentication on all services, especially webmail, VPNs and accounts on critical systems.
- 02Patch known exploited vulnerabilities first, especially on VPNs, firewalls and other internet-facing devices.
- 03Keep offline, encrypted, immutable backups, test restoring them, and protect NAS devices from remote reset.
- 04Audit domain controllers, servers and Active Directory for unrecognized or inactive accounts, and apply least privilege.
- 05Report incidents to the FBI, the Secret Service or CISA in the US, or to Report Fraud in the UK.
Frequently asked questions
How many victims has SafePay claimed?
CISA says at least 600 separate victims across multiple critical infrastructure sectors since August 2024, in North America, South America, Europe and Australia. The true number is higher than leak-site counts suggest, because the site lists only victims who did not pay.
How does SafePay break in?
The advisory lists stolen or guessed passwords, brute force, VPN access (including IP addresses linked to the Mullvad VPN provider and phished account profiles), and automated exploitation of flaws in internet-exposed systems such as CVE-2024-40766.
What does SafePay do to backups?
CISA says it stops the Volume Shadow Copy Service and resets network-attached storage holding backups to factory settings. In some cases all network-attached backups were deleted.
Should victims pay the ransom?
The authoring agencies advise against paying ransoms, noting that payment does not guarantee recovery. They ask victims to report incidents promptly either way.
Sources
- StopRansomware: SafePay (AA26-293A), CISA, 2026-10-20
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs, BleepingComputer, 2026-10-21
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.