CISA and FBI warn SafePay ransomware gang has hit about 600 organizations

CISA, the FBI, the US Secret Service and international partners released a joint advisory warning that SafePay is one of the most active ransomware groups of 2026, impacting about 600 victims across the Americas, Europe and Australia ^[1]. SafePay gains access by compromising credentials and exploiting known vulnerabilities in internet-facing devices, often via VPN, then deletes or disables backups, steals data and encrypts systems, pressuring victims by threatening leaks and sometimes calling them ^[1]. The agencies urge organizations to keep systems and firmware up to date, require MFA, prioritize patching exploited vulnerabilities in internet-facing systems, and maintain offline backups and network segmentation ^[1].

Industries mainly affected: Cross-industry

1. Keep operating systems, software and firmware up to date ^[1].
2. Require multifactor authentication ^[1].