Science & Tech · Cybersecurity · 2 hrs ago
SafePay ransomware gang breached more than 600 organizations since 2024
SafePay has breached at least 600 organizations since August 2024, according to a joint advisory from U.S., German and U.K. agencies.
The group has targeted businesses and critical infrastructure across several continents, including North and South America, Europe and Australia.
It breaks into networks using methods such as stolen or guessed passwords, phishing and flaws in internet-facing systems.
After getting in, attackers steal sensitive files, disrupt security and encrypt systems, then demand cryptocurrency and threaten to publish the stolen data.
Paying a ransom does not guarantee files will be recovered, the agencies warn.
They urge organizations to use multifactor authentication, limit administrative access, update systems and report incidents to law enforcement.
The advisory also gives security teams technical details to help them identify and defend against SafePay activity.
CISA and international law enforcement agencies say the SafePay ransomware group has breached at least 600 organizations since August 2024.
The victims include businesses and critical infrastructure organizations across multiple sectors and regions.
The agencies say SafePay gains access through exposed credentials, password attacks, phishing and vulnerabilities in internet-facing systems.
The group steals files before encrypting systems and may threaten to publish stolen data if victims do not pay.
The agencies warn that paying a ransom does not guarantee recovery of encrypted files.
- Who
- The SafePay ransomware group is accused of the breaches.
- What
- It has breached at least 600 organizations, according to an advisory by CISA and international law enforcement agencies.
- When
- Since August 2024.
- Where
- Worldwide, including North America, South America, Europe and Australia.
- Why
- Not stated
This story does not have two clearly opposing sides.
SafePay emerged as a private ransomware group, according to BleepingComputer.
The advisory includes information on SafePay activity observed during investigations in this period.
The Record said the most recent incident covered by the advisory occurred in August.
The Record and BleepingComputer reported on the agencies’ advisory.
- Organizations breached
- At least 600 since August 2024
- Regions affected
- North America, South America, Europe and Australia
- Group type
- Private ransomware group that does not work with affiliates
- Agencies
- CISA, FBI, U.S. Secret Service, German and U.K. law enforcement agencies
- Observed activity period
- November 2024–August 2026
3 sources
What people are saying
SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024.
SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access—particularly the IP addresses of VPN provider 'Mullvad'.
Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones.