Federal agencies warn SafePay ransomware has reached at least 600 organizations
WASHINGTON — Federal investigators have warned businesses and critical infrastructure operators that the SafePay ransomware group has affected at least 600 organizations across multiple sectors since August 2024.
The Cybersecurity and Infrastructure Security Agency, FBI, Secret Service and international partners issued a joint advisory Oct. 20 describing the group’s activity and defenses organizations can use. The warning covers victims in the Americas, Europe and Australia.
CISA’s announcement of the advisory says attackers use exposed credentials, password attacks, phishing and weaknesses in internet-facing systems. The agencies recommend quickly fixing known exploited vulnerabilities, strengthening account security and limiting administrative privileges.
The warning describes a pattern of incidents, not a claim that every organization using a particular product has been compromised. It also does not establish the nationality of every person involved in the group.
Two forms of pressure
According to the joint advisory, SafePay actors steal information and encrypt files, creating pressure through both the loss of access and threats to release data. The agencies describe ransom demands in cryptocurrency and, in some cases, direct calls to victims.
Attackers can also interfere with recovery by deleting copies or disrupting backup storage. That makes the ability to restore operations a separate concern from whether an organization possesses a backup in the first place.
The advisory contains technical indicators from investigations and cautions that infrastructure associated with past malicious activity can later be reassigned. Investigators should therefore corroborate indicators with current evidence rather than treat every historical address as permanently malicious.
Why the warning extends beyond IT
A ransomware incident can raise several questions at once: which systems are unavailable, what information may have been taken, which services must continue and how the organization will communicate. Restoring access does not automatically answer whether stolen information remains exposed.
That distinction explains the emphasis on both reducing the chance of intrusion and limiting the consequences of an incident. Account controls, software maintenance and restricted privileges address different parts of the problem.
The agencies’ advice is directed at defenders. It does not require an organization to assume that every unusual message or system outage is a SafePay attack. Attribution requires evidence, and immediate operational decisions may have to be made before the attacker is identified.
Planning before disruption
The National Institute of Standards and Technology’s cybersecurity framework treats risk management as a continuing organizational responsibility. It helps organizations connect business objectives, key resources, protective measures and plans to detect, respond to and recover from incidents.
That framework is broader than a checklist for one ransomware family. A defense built only around the name in the latest warning can miss weaknesses that several different criminal groups could exploit.
For a critical service provider, the practical question is what happens if essential information or software becomes unavailable. The answer can involve operating procedures, staffing and supplier relationships as well as technical recovery.
Federal guidance does not guarantee that a particular organization is secure, and the 600-organization figure should not be read as a prediction of the next attack’s size. It describes the scale identified in the agencies’ warning.
The immediate takeaway is narrower and actionable: review the advisory, address exposed weaknesses and ensure that recovery plans can operate under real disruption. SafePay’s reach makes those preparations urgent, but the underlying responsibility extends well beyond a single criminal group or one month’s threat bulletin.
