SafePay Ransomware Hits at Least 600 Organizations, Targets Critical Infrastructure

SafePay ransomware actors have compromised at least 600 organizations since August 2024, including victims across multiple critical infrastructure sectors, according to an international advisory involving CISA, the FBI, and German and U.K. authorities. Victims span the United States, Europe, and other regions, and authorities describe SafePay as among the most active ransomware groups in 2026. The private operation does not use affiliates. Attackers gain access through stolen or phished credentials, password guessing, and exploitation of VPNs and other internet-facing systems, then manipulate accounts and use legitimate tools for lateral movement and data theft before deploying ransomware.

SafePay combines encryption with threats to expose stolen data, sets cryptocurrency demands based on company revenue, and uses telephone calls to pressure victims. Actors disable security protections and may undermine recovery by deleting shadow copies and resetting backup storage devices. The group has claimed attacks on Microlise and Conduent; the Conduent breach disrupted U.S. services and prompted litigation, with the company announcing an $80 million class-action settlement. Authorities urged organizations to strengthen authentication, restrict administrative privileges, patch exposed infrastructure, and report incidents, warning that ransom payments do not guarantee file recovery.