FBI Warns SafePay Ransomware Has Hit 600 Organizations — Here’s How Businesses Can Protect Themselves

October 21, 2026

Federal cybersecurity and law enforcement agencies are warning businesses about a ransomware operation that has affected at least 600 organizations worldwide, including companies operating in critical infrastructure sectors.

The group, known as SafePay, has been active since August 2024 and was among the most active ransomware operations in 2026, according to a new federal advisory.

In an October 20 announcement, the Cybersecurity and Infrastructure Security Agency (CISA) said it joined the FBI, U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom to warn organizations about the group’s activities.

The warning highlights how cybercriminals can exploit stolen passwords, vulnerable computer systems, and legitimate administrative tools to take control of business networks.

SafePay Ransomware Has Affected at Least 600 Organizations

According to CISA, SafePay has targeted businesses and critical infrastructure organizations across North America, South America, Europe, and Australia.

The group uses ransomware, a type of malicious software that can encrypt files and prevent organizations from accessing important information or computer systems.

Attackers then demand payment, frequently in cryptocurrency, in exchange for restoring access.

SafePay also uses a tactic known as double extortion, in which criminals steal sensitive information before encrypting files and threaten to publish the stolen data if their demands aren’t met.

For affected businesses, these attacks can create financial pressure through operational disruptions, recovery expenses, potential data exposure, and demands for ransom payments.

How Criminals Gain Access to Business Networks

Federal investigators identified several methods SafePay uses to infiltrate organizations.

These include obtaining stolen login credentials, repeatedly guessing passwords, exploiting security weaknesses in virtual private networks (VPNs), and using phishing attacks to trick employees into revealing account information.

The group has also exploited vulnerabilities in internet-connected equipment and software that businesses use to manage remote access and protect their networks.

Once attackers gain entry, they may take over existing accounts with administrative privileges or create new accounts that give them greater control over company systems.

Investigators also found that SafePay operators sometimes change legitimate users’ passwords, preventing employees and administrators from accessing their own networks.

Attackers Can Use Legitimate Software to Avoid Detection

One concerning aspect of SafePay’s activity is its use of ordinary computer administration tools to carry out attacks.

According to the joint advisory, the group has used software and services such as PowerShell, Remote Desktop Protocol, and Windows Remote Management to move through compromised networks.

These tools are commonly used by legitimate IT professionals, which can make suspicious activity more difficult to distinguish from normal system maintenance.

Attackers may use their access to locate sensitive files, disable security protections, and prepare systems for ransomware deployment.

In some incidents, SafePay operators have also targeted backup systems, making recovery more difficult after an attack.

What Ransomware Attacks Can Cost Businesses

Although the advisory focuses on cybersecurity, the potential financial consequences extend well beyond the ransom demand itself.

A business that loses access to payroll records, customer information, accounting systems, or other essential files may struggle to continue normal operations.

Recovery efforts can involve hiring cybersecurity specialists, restoring data, replacing compromised equipment, and investigating whether sensitive information was stolen.

Companies may also face contractual obligations, notification requirements, or additional expenses depending on the type of information affected and applicable laws.

For small businesses operating on tight budgets, even a temporary disruption can create significant financial strain, making preventive cybersecurity measures an important part of financial risk management.

Federal Agencies Recommend Several Security Measures

CISA and its partners are urging organizations to strengthen their defenses against ransomware attacks.

Their recommendations include keeping software updated, particularly VPN systems, firewalls, and other internet-facing equipment that attackers frequently target.

Organizations should also implement multifactor authentication, which requires additional verification beyond a password when accessing sensitive accounts.

Limiting administrative privileges to employees who genuinely need them can reduce the damage attackers may cause if an account is compromised.

Businesses should also review their backup and recovery procedures, restrict unnecessary remote access, and monitor for unusual account activity or unauthorized system changes.

Why Paying a Ransom Doesn’t Guarantee Recovery

Businesses facing a ransomware attack may feel pressured to pay criminals to restore access to their systems.

However, federal cybersecurity authorities warn that making a ransom payment does not guarantee that encrypted files will be recovered or that stolen information will remain private.

Even after receiving payment, attackers may fail to provide a working decryption tool or may retain copies of stolen information.

SafePay’s use of data theft and threats to publish sensitive files adds another layer of pressure for organizations trying to restore operations.

Businesses experiencing a suspected ransomware incident should seek qualified incident-response assistance and report the attack to the appropriate authorities.

Where Businesses Can Find Official Guidance

The joint advisory is part of the federal government’s ongoing #StopRansomware initiative, which provides information about ransomware threats and ways organizations can reduce their exposure.

The full SafePay advisory includes technical indicators that cybersecurity professionals can use to identify suspicious activity associated with the group.

Organizations can review official guidance through StopRansomware.gov and CISA’s cybersecurity resources.

The advisory is particularly relevant for businesses that rely on remote network access, store sensitive customer information, or operate systems essential to everyday services.

For business owners, the central lesson is that cybersecurity failures can quickly become financial emergencies, and protecting company data should be part of a broader strategy for safeguarding business operations and customer trust.