Organisation

SafePay

Ransomware group active since August 2024, credited by Western agencies with at least 600 victims.

Six agencies from the United States, Germany and Britain said on 20 October 2026 that SafePay had affected at least 600 victims.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Why are years-old flaws still opening networks to SafePay?

Timeline for SafePay

#15 20 Oct

Gained access through five old flaws and hit at least 600 victims

Cybersecurity: Threats and Defences: Six agencies tie SafePay to old flaws

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

SafePay is a ransomware operation that emerged in August 2024. In joint advisory AA26-293A, six cyber and law-enforcement agencies in the United States, Germany and Britain said the group had affected at least 600 victims across North America, South America, Europe and Australia.

The agencies describe intrusions using stolen or guessed credentials, phishing and known flaws in internet-facing systems. They also report data theft, file encryption and efforts to disable recovery, including resets of network-attached storage. The agencies present these methods as observed patterns rather than Universal steps. These are agency assessments; the advisory does not name victims or publish its underlying count.

Key Issues

Ransomware access

Agencies trace SafePay through old flaws

Six agencies from the United States, Germany and Britain published a joint advisory on 20 October 2026. They credited the SafePay ransomware group with at least 600 victims.

The agencies named five vulnerabilities used for entry, dating from 2020 to 2024. All five had remained on CISA's exploited-flaw list for two to three years. Two affected Veeam backup servers, systems that organisations use when restoring data and services after an attack. The advisory therefore linked SafePay's reach to patching gaps in long-known flaws rather than newly disclosed weaknesses.

Common Questions

What is SafePay ransomware?

SafePay is a ransomware group that government agencies say steals data, encrypts files and pressures victims to pay.Source: CISA joint advisory AA26-293A

How many victims has SafePay affected?

Six agencies assessed that SafePay had affected at least 600 victims by October 2026. The advisory gives a floor and does not publish the underlying victim list.Source: CISA joint advisory AA26-293A

How does SafePay enter company networks?

The joint advisory describes stolen or guessed credentials, phishing and exploitation of known flaws in internet-facing systems.Source: CISA joint advisory AA26-293A

Source Material

#StopRansomware: SafePay Ransomware

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.