FBI, CISA Warn SafePay Ransomware Hit 600 Firms [2026]

The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Secret Service issued a joint advisory on October 20, 2026, warning that a ransomware group called SafePay has hit at least 600 organizations worldwide since surfacing in August 2024, with multiple critical infrastructure sectors among the victims. The advisory, titled “#StopRansomware: SafePay Ransomware” and tracked under identifier AA26-293A, lands at a moment when ransomware crews are increasingly treating hospitals, utilities, and manufacturers as primary targets rather than opportunistic afterthoughts.

The timing matters. Federal agencies rarely coordinate a joint advisory of this scope unless a threat actor has crossed a threshold that justifies pulling defenders’ attention away from dozens of other active campaigns. SafePay cleared that bar, according to the joint advisory published by CISA , which lays out the group’s access methods, post-compromise behavior, and recommended mitigations in granular detail. This article breaks down what the advisory says, why SafePay has grown this fast, how it stacks up against other major ransomware operations, and what organizations in critical infrastructure sectors should expect .

Don't miss new tech stories on Google

Add Shattered once in the Google app and our stories show up in your news suggestions.

FBI and CISA Issue Joint Advisory on SafePay Ransomware

Advisory AA26-293A was released on October 20, 2026, under the StopRansomware initiative, a standing partnership between CISA, the FBI, and other federal agencies that publishes technical breakdowns of active ransomware campaigns as they’re identified. This particular release names SafePay as the subject and credits CISA, the FBI, and the U.S. Secret Service as the lead issuing organizations, working alongside international partners. That tri-agency byline is itself a signal: Secret Service involvement typically points to a financial crimes angle, which tracks with SafePay’s ransom demands being made in cryptocurrency.

Coverage of the advisory spread quickly across security trade outlets. Cybersecurity Dive reported on the advisory’s release, and The HIPAA Journal flagged the healthcare-sector implications given SafePay’s documented reach into regulated industries. Both outlets, along with Infosecurity Magazine and Technology Org, treated the advisory as the top cybersecurity story of the day, a notable feat given how saturated the ransomware beat has become by late 2026.

What makes AA26-293A different from a routine threat bulletin is the specificity. Rather than offering abstract warnings, the advisory walks through SafePay’s intrusion chain step by step: how the group gets in, what it does once inside, and what defenders can do to break that chain at each stage. That structure is standard for StopRansomware advisories, but the level of detail in this one reflects how much visibility investigators have accumulated on SafePay’s operations over roughly two years of activity.

Who Is SafePay and How Long Has It Been Active

SafePay first appeared on investigators’ radar in August 2024, which puts its active lifespan at just over two years as of this advisory. That’s a meaningful run in ransomware terms. Many ransomware brands cycle out within 12 to 18 months, either because law enforcement disrupts their infrastructure, affiliates splinter off to rebrand under a new name, or the operators simply retire with their proceeds. SafePay’s persistence through two full years, without the kind of high-profile takedown that ended other groups’ runs, suggests either unusually disciplined operational security or a structure resilient enough to absorb setbacks without collapsing.

The advisory does not disclose granular detail SafePay’s organizational structure, such as whether it operates on a ransomware-as-a-service model with independent affiliates or runs as a more tightly controlled single operation. What is documented is the group’s geographic reach: victims span North America, South America, Europe, and Australia, according to the joint advisory. That spread across four continents in roughly two years indicates a group that isn’t limiting itself by language, region, or industry vertical, a pattern increasingly common among ransomware operations that prioritize volume over selectivity.

The 600-plus victim count itself deserves context. Federal advisories tend to report conservative, verifiable figures rather than extrapolated estimates, so “at least 600 organizations” should be read as a floor, not a ceiling. FBI Assistant Director Brett Leatherman underscored that scale directly, noting that “SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors.” That statement, issued alongside the advisory, frames SafePay as one of 2026’s most prolific ransomware operations by victim count alone.

Inside Advisory AA26-293A: What CISA and the FBI Disclosed

StopRansomware advisories follow a consistent template: attribution, scope, technical indicators, and mitigations. AA26-293A hits each of those marks for SafePay. On attribution and scope, the advisory confirms the group’s name, its active-since date, its victim count, and its targeted regions. On technical indicators, it details the specific access methods and post-compromise behaviors SafePay relies on. On mitigations, it offers a prioritized list of defensive actions aimed at network defenders, IT administrators, and security operations teams at organizations that might be in SafePay’s crosshairs.

Brett Leatherman, the FBI’s assistant director for the cyber division, framed the advisory’s purpose in plain terms, describing it as giving network defenders clear, actionable guidance to protect their organizations from one of the year’s most active ransomware groups, a point he made in the official CISA release. That framing is deliberate. StopRansomware advisories exist specifically to compress the gap between what federal investigators learn during incident response engagements and what the broader defender community has access to, since most organizations never get a direct look at how a specific threat actor operates until after they’ve already been breached.

CISA’s own statement accompanying the release reinforced the urgency around patching. The agency said it “encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised,” a point that lines up with how SafePay is documented to gain initial access. That urgency echoes a pattern seen across other recent federal guidance, including the scramble around the Ivanti Connect Secure zero-day disclosed earlier this year , where unpatched internet-facing VPN appliances became the entry point for intrusions long before most IT teams had applied the fix.

The Scale: More Than 600 Victims Across Critical Infrastructure

The headline figure in AA26-293A is the victim count: at least 600 organizations across multiple critical infrastructure sectors. The advisory does not break that figure down by specific sector percentages, so any attempt to say exactly what of victims came from healthcare versus manufacturing versus energy would be speculation beyond what’s confirmed. What is confirmed is the breadth: SafePay has been active across North America, South America, Europe, and Australia, meaning this isn’t a regional nuisance but a globally distributed threat.

That scale puts SafePay in rare company among ransomware operations tracked by federal advisories in 2026. Few groups accumulate a confirmed victim count in the hundreds before law enforcement either disrupts their infrastructure or names them in a formal advisory. The fact that SafePay reached this point without a disclosed takedown action suggests the group has either evaded sustained law enforcement pressure or is only now facing the kind of coordinated response that previously ended other ransomware brands’ operations.

Critical infrastructure targeting carries weight beyond the individual victim organizations. When ransomware hits hospitals, water utilities, or transportation systems, the downstream effects extend to patients, residents, and supply chains that have no direct relationship with the breached entity. That dynamic played out earlier this year when water utility systems across a dozen states, including more than 30 in Minnesota alone, were hit by a wave of intrusions , underscoring how thin the margin for error has become in sectors that can’t simply take systems offline without real-world consequences.

How SafePay Breaks In: Access Methods Explained

The advisory documents three primary access methods SafePay relies on to gain an initial foothold: compromised or guessed passwords, exploitation of vulnerabilities in internet-facing devices, and phishing. None of these three vectors are novel, which is itself a notable finding. SafePay isn’t succeeding because it has developed some exotic zero-day capability; it’s succeeding because a large enough of organizations still have exploitable gaps in basic credential hygiene, patch management, and email security.

Compromised or guessed passwords as an access vector points directly at weak or reused credentials, often on remote access tools, VPN concentrators, or administrative portals that are exposed to the internet. Exploitation of vulnerabilities in internet-facing devices is the more technically involved vector, and it’s the one that tends to generate the most urgent patching advisories, since a single unpatched appliance can serve as the single point of failure for an entire network. Phishing remains the most human-dependent vector, relying on a single employee clicking a malicious link or opening a weaponized attachment to hand attackers their first set of credentials or code execution.

The overlap between SafePay’s exploitation of internet-facing device vulnerabilities and the broader 2026 pattern of VPN and edge-device compromises is hard to miss. Organizations that have fallen behind on patch cadence for remote access infrastructure are effectively leaving a door unlocked, and groups like SafePay are demonstrably willing to walk through it. The same logic applies to the steady drumbeat of monthly patch cycles; Microsoft’s own October 2026 Patch Tuesday release addressed 1,413 CVEs, including one actively exploited zero-day , a reminder of just how large the attack surface is that defenders are expected to keep current.

Post-Compromise Playbook: From Lateral Movement to Encryption

Once SafePay actors establish initial access, the advisory documents a consistent sequence of post-compromise activity. That includes creating new accounts or taking over existing ones, using legitimate system administration tools to move laterally across the network, identifying files considered valuable enough to steal, disabling security protections, exfiltrating data, and finally encrypting files. This sequence, often called “living off the land,” is deliberately designed to blend malicious activity into the noise of normal network administration, making early detection substantially harder for security teams relying on signature-based tools alone.

The decision to disable security protections before encryption is a critical detail. It means SafePay actors aren’t simply hoping to slip past endpoint detection; they’re actively neutralizing it once they have sufficient privileges. That step typically requires administrative or domain-level access, which reinforces why the advisory’s access-vector findings, compromised passwords and exploited internet-facing devices, matter so much: both are common paths to the kind of elevated privilege needed to turn off defenses before the final encryption stage.

Data theft ahead of encryption has become close to universal among modern ransomware operations, and SafePay’s documented behavior fits that pattern exactly. The ransom demand itself is made in cryptocurrency, with threats to publish stolen information if payment isn’t made, a double-extortion model that has become the industry standard since groups like Maze popularized it several years ago. That combination, encrypted systems plus a leak threat, is designed to maximize pressure on victims even if they have reliable backups that would otherwise let them recover without paying.

Why Critical Infrastructure Sectors Are in the Crosshairs

Ransomware operators have increasingly gravitated toward critical infrastructure targets for a straightforward reason: these organizations often can’t afford extended downtime, which makes them more likely to pay quickly and at a higher amount than a retailer or media company that can absorb a few days offline. A hospital that can’t access patient records, a water utility that can’t monitor treatment systems, or a manufacturer that can’t run its production line all face pressure that goes well beyond lost revenue.

That dynamic has played out repeatedly across 2026’s breach disclosures. Large-scale breaches at institutions ranging from state agencies to school districts have shown how deep the exposure runs once attackers get a foothold; the UK Legal Aid Agency breach, which exposed roughly 250,000 records with some data tracing back to 1978 , illustrated how long-retained records can turn a single intrusion into a decades-spanning exposure event. SafePay’s documented reach into multiple critical infrastructure sectors fits the same broader trend: attackers are deliberately selecting targets where disruption translates directly into leverage.

The advisory doesn’t specify which individual critical infrastructure sectors have been hit hardest by SafePay, and any claim naming specific sectors beyond what’s confirmed would be speculation. What can be said with confidence is that the group’s targeting strategy, combined with its two-year operational runway and four-continent footprint, places it among the more consequential ransomware threats federal agencies have flagged this year.

SafePay in Context: How It Compares to Other Ransomware Operations

Ransomware groups differ meaningfully in structure, targeting discipline, and how long they manage to operate before law enforcement or internal splintering ends their run. SafePay’s defining characteristics, according to the joint advisory, are its reliance on common, well-understood access vectors rather than novel exploits, its broad geographic spread, and its sustained two-year activity window without a disclosed takedown. The table below places those characteristics alongside other ransomware operations that have drawn sustained law enforcement and industry attention in recent years, based on widely reported patterns rather than precise, unverified statistics.

What stands out when comparing SafePay to these other operations is how unremarkable its toolkit is on paper. It isn’t winning through technical sophistication; it’s winning through consistency and volume, applying the same basic access methods across hundreds of targets until enough of them have an exploitable gap. That’s arguably more concerning from a defensive standpoint than a group relying on a single novel exploit, because it means patching one vulnerability class doesn’t eliminate the threat.

Expert Reaction: What Federal Officials Are Saying

Federal officials involved in the advisory’s release were direct both the scale of the threat and the purpose of going public with this level of detail. Brett Leatherman, the FBI’s assistant director for the cyber division, said the joint advisory was meant to give network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups, a framing that positions the document as a practical tool rather than a general warning.

Leatherman was equally direct the scale SafePay has reached, stating that SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. He also framed the advisory’s value in terms of risk reduction rather than elimination, noting that by following the recommendations in the advisory, network defenders can significantly reduce both the likelihood and the impact of a SafePay ransomware attack. That phrasing, “reduce” rather than “prevent,” reflects a realistic assessment: no advisory, however detailed, can fully close every gap an organization might have.

CISA’s institutional statement reinforced the same urgency from the patching side, encouraging organizations to review and implement recommended mitigations, specifically calling out the need to urgently patch known exploited vulnerabilities referenced in the advisory and to conduct forensic triage to check whether systems have already been compromised. That second instruction, forensic triage, is worth sitting with: it implies that some organizations reading the advisory for the first time may already be compromised without knowing it, a scenario that’s common given SafePay’s documented pattern of disabling security protections before encryption.

Historical Context: Ransomware Advisories From LockBit to SafePay

The StopRansomware advisory series has become a running chronicle of which threat actors federal agencies consider significant enough to warrant a formal, detailed technical breakdown. Over the past several years, that list has included groups whose names became shorthand for major incidents: LockBit’s ransomware-as-a-service operation before its 2024 disruption, AlphV/BlackCat’s role in high-profile healthcare-sector attacks, and a steady stream of smaller but still damaging operations that rarely made mainstream headlines but accumulated hundreds of victims each.

What’s changed over that period isn’t the basic mechanics of ransomware, encrypt files, demand payment, threaten to leak data if refused, but the velocity at which new groups reach advisory-worthy scale. SafePay going from first observed activity in August 2024 to a joint federal advisory naming more than 600 victims by October 2026 represents roughly a 26-month window. That’s a fast climb relative to historical patterns, where groups often needed longer to accumulate a victim count large enough to justify a dedicated advisory.

Part of that acceleration likely reflects how commoditized ransomware tooling and access-broker markets have become. Initial access brokers selling compromised credentials, combined with an abundance of unpatched internet-facing devices, lower the barrier for any sufficiently organized group to scale quickly. This mirrors a broader shift in the threat landscape where even automated and AI-assisted intrusion attempts have started reaching meaningful scale at low cost; one recent disclosure found that AI agents were used to breach more than 100 firms at a cost of roughly $50 per targeted site , a figure that illustrates just how cheap large-scale intrusion attempts have become relative to the damage they can inflict.

Market Impact: Cyber Insurance, Security Spending, and Vendor Response

Advisories of this scope tend to ripple through the cybersecurity vendor and insurance markets within days of release. Security vendors that sell endpoint detection, identity protection, and vulnerability management tools typically update their threat intelligence feeds and marketing messaging almost immediately to reference newly named groups like SafePay, since being able to tell prospective customers “we already detect this specific threat” is a meaningful sales point in a crowded market.

Cyber insurance underwriters pay close attention to these advisories too, particularly the documented access vectors. An advisory confirming that a prolific group relies heavily on compromised passwords and unpatched internet-facing devices gives underwriters concrete criteria to fold into renewal questionnaires: multi-factor authentication enforcement, patch cadence for edge devices, and privileged account monitoring. Organizations in critical infrastructure sectors that can’t demonstrate strong controls across those specific categories may see renewal terms tighten, a pattern that has already played out across the broader cyber insurance market as ransomware claims have climbed.

For critical infrastructure operators specifically, the advisory adds pressure to budget conversations that were likely already underway. Boards and executives tend to treat a named federal advisory differently than generic industry warnings, since it carries the implicit message that the threat has been validated by law enforcement investigation rather than vendor marketing. That dynamic often accelerates approval for security spending that had been stuck in planning cycles, particularly around patch management automation and identity security, two categories directly implicated by SafePay’s documented access methods.

While the advisory’s full technical mitigation list runs long, as is typical of StopRansomware publications, the core categories map directly onto the access methods and post-compromise behaviors documented for SafePay. Organizations evaluating their own exposure should prioritize the areas summarized below, cross-referenced against the specific tactics the advisory confirms SafePay relies on.

That last mitigation category, offline and tested backups, deserves emphasis. SafePay’s documented workflow includes disabling security protections before encryption, which in some ransomware cases extends to targeting backup systems directly if they’re reachable from the compromised network. Backups that are only accessible from the same network segment as production systems offer far less protection than backups that are genuinely isolated, whether through air-gapping, immutable storage, or offline rotation.

What Comes : Predictions for SafePay and Ransomware Defense

With the advisory now public, several developments seem likely over the coming months, based on how StopRansomware disclosures have played out historically.

Increased law enforcement pressure: naming a group publicly in a joint federal advisory often precedes more aggressive investigative and disruption efforts, as happened with earlier groups before their infrastructure was eventually taken down.

A possible rebrand attempt: ransomware operations that come under this level of federal scrutiny sometimes respond by rebranding under a new name with overlapping personnel, a pattern seen repeatedly across the ransomware ecosystem in recent years.

Faster patch adoption for the specific vulnerability classes named in the advisory, as critical infrastructure operators move to close the exact gaps SafePay has been exploiting.

Expanded vendor detection coverage, as security companies update threat intelligence products to specifically flag SafePay indicators of compromise referenced in the advisory.

Continued targeting of critical infrastructure broadly, even if SafePay specifically slows down, since the underlying economic incentive, faster payment from organizations that can’t tolerate downtime, isn’t going away.

None of these outcomes are guaranteed, and the advisory itself doesn’t forecast what happens ; these are reasonable expectations based on how similar situations have unfolded with other named ransomware groups. Organizations shouldn’t wait to see which of these predictions plays out before acting on the advisory’s mitigation guidance.

How This Fits the Broader 2026 Ransomware Threat Landscape

SafePay’s advisory doesn’t exist in isolation. It lands in a year where ransomware groups have increasingly layered additional pressure tactics onto the standard encrypt-and-leak model. Reporting on ransomware extortion tactics this year found that a meaningful of groups have begun threatening victims’ families directly as a pressure tactic, with roughly 40% of tracked groups incorporating real-world threats into their extortion playbook, according to industry tracking of ransomware escalation patterns published earlier this year . The SafePay advisory doesn’t confirm that specific behavior for this group, but it reflects the same broader trend of ransomware operators escalating pressure well beyond simple file encryption.

The critical infrastructure targeting pattern SafePay exhibits also lines up with a year defined by repeated attacks on systems that keep essential services running. From water treatment systems to healthcare networks to state agencies, 2026 has seen a steady cadence of intrusions into organizations where downtime carries consequences beyond financial loss. That pattern has pushed federal agencies toward more frequent, more detailed joint advisories, a shift from the less frequent, more generic warnings common just a few years ago.

For organizations trying to prioritize limited security budgets against an expanding list of named threats, the practical takeaway from SafePay’s advisory is less this one group and more the access vectors it exploits. Weak credentials, unpatched internet-facing devices, and phishing remain the three most common doors into enterprise networks across nearly every major ransomware operation tracked this year. Closing those doors reduces exposure to SafePay specifically, but it also reduces exposure to whichever group gets named in the advisory.

Frequently Asked Questions

What is SafePay ransomware?

SafePay is a ransomware group that has been active since August 2024. According to the joint FBI-CISA advisory released October 20, 2026, SafePay has targeted at least 600 organizations across North America, South America, Europe, and Australia, with multiple critical infrastructure sectors among the victims.

What is advisory AA26-293A?

AA26-293A is the identifier for the joint cybersecurity advisory titled “#StopRansomware: SafePay Ransomware,” released by CISA, the FBI, and the U.S. Secret Service, with international partners, on October 20, 2026. It details SafePay’s access methods, post-compromise behavior, and recommended mitigations.

How does SafePay gain initial access to networks?

The advisory documents three primary access methods: compromised or guessed passwords, exploitation of vulnerabilities in internet-facing devices, and phishing. None of these require novel or exotic exploitation techniques, which is part of why the group has scaled to hundreds of victims.

How many organizations has SafePay affected?

The joint advisory states SafePay has affected at least 600 organizations across multiple critical infrastructure sectors. FBI Assistant Director Brett Leatherman confirmed that more than 600 victims have been targeted worldwide. Any more specific or higher figure beyond “at least 600” is not confirmed by the advisory.

Does SafePay steal data before encrypting files?

Yes. The advisory documents that SafePay actors steal data prior to encryption and make ransom demands in cryptocurrency, with threats to publish the stolen information if the ransom isn’t paid. This double-extortion approach is standard across most major ransomware operations active in 2026.

What should organizations do in response to the SafePay advisory?

CISA recommends organizations review and implement the advisory’s mitigations, prioritizing urgent patching of known exploited vulnerabilities referenced in the document and conducting forensic triage to determine whether systems have already been compromised. Enforcing multi-factor authentication and maintaining tested, offline backups are also central to the advisory’s guidance.

Which agencies issued the SafePay advisory?

The advisory was issued jointly by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.S. Secret Service, together with international partners.

Is SafePay connected to other known ransomware groups like LockBit or AlphV?

The advisory does not state that SafePay is directly connected to LockBit, AlphV/BlackCat, or any other named ransomware operation. Any claim of direct lineage between SafePay and a prior group would go beyond what federal agencies have confirmed and should be treated as unverified.