SafePay ransomware has breached at least 600 organisations since August 2024
A joint advisory from CISA, the FBI, the US Secret Service and international partners says SafePay has affected at least 600 organisations across critical infrastructure sectors in the Americas, Europe and Australia. The agencies say the group steals data before encrypting systems, then demands cryptocurrency and threatens to publish stolen files if victims do not pay.
Bottom line — The agencies urge organisations to patch exposed systems, enable multifactor authentication and keep encrypted, offline backups.
Go deeper 5
-
The agencies say SafePay typically gains access through stolen or guessed passwords, phishing, VPN access and vulnerabilities in internet-facing devices.
-
According to the advisory, attackers use legitimate system tools to move through networks and disable security protections, making activity harder to spot.
-
The group can delete or disable backups before encrypting files, the agencies warn.
-
The FBI and CISA recommend network segmentation, limiting administrative access and monitoring for suspicious activity.
-
The agencies say paying a ransom does not guarantee that files will be recovered.