Skip to content
SafePay Ransomware Compromises 600 Critical Infrastructure Organizations

SafePay Ransomware Compromises 600 Critical Infrastructure Organizations

First seen 21 Oct 2026, 12:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 13:17 UTC
  • •SafePay has compromised 600 critical infrastructure organizations worldwide.
  • •The group employs various access techniques, including credential exposure and VPN exploitation.
  • •SafePay is linked to other ransomware groups and was the most active in May 2026.

The SafePay ransomware group has compromised at least 600 critical infrastructure organizations globally, as reported by CISA and other agencies. Active since August 2024, SafePay has targeted various sectors across North America, South America, Europe, and Australia. The advisory details SafePay's use of multiple initial access techniques, including credential exposure and VPN exploitation. Once inside networks, attackers gain administrative privileges and employ living-off-the-land techniques to navigate systems. The group utilizes a double extortion model, threatening to publish stolen data if ransoms are not paid. SafePay has been particularly active in 2026, with reports indicating it was the most active ransomware group in May 2026. The group is believed to have connections to other notorious ransomware entities like LockBit and ALPHV/BlackCat. Organizations are urged to enhance their security measures against this evolving threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-08-01
SafePay emerges
SafePay ransomware group begins operations, targeting critical infrastructure globally.
Infosecurity-Magazine
2026-05-01
Most active ransomware group
SafePay is reported as the most active ransomware group, with 70 claimed attacks in May 2026.
Infosecurity-Magazine
2026-10-16
Conduent settlement
Conduent agrees to pay $80 million to settle a class action lawsuit related to a SafePay data breach.
Infosecurity-Magazine

More articles in this cluster (2)

Following this threat?

Track Akira in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

What sectors are affected by SafePay?
SafePay has targeted critical infrastructure organizations across various sectors in North America, South America, Europe, and Australia.
What techniques does SafePay use to gain access?
SafePay employs credential exposure, brute force attacks, VPN exploitation, and other techniques to gain initial access.
How can organizations protect themselves from SafePay?
Organizations should enhance their security measures, including monitoring for suspicious activity and applying patches for known vulnerabilities.