On October 20, 2026, CISA, the FBI and the U.S. Secret Service published joint advisory AA26-293A (#StopRansomware: SafePay Ransomware) with three international partners: Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit. The advisory says SafePay has hit at least 600 organizations across multiple critical infrastructure sectors since August 2024, in North America, South America, Europe and Australia. The agencies call it "one of the most active ransomware groups." The advisory names five exploited CVEs, publishes STIX-formatted indicators of compromise, and warns that paying a ransom does not guarantee files will be recovered.
What Happened
The advisory is the first coordinated government account of SafePay's full campaign. Earlier figures were much lower. FortiGuard Labs' threat actor profile, published in February 2026, put the group's victims at "more than 300 organizations worldwide." The government's figure of at least 600 covers only critical infrastructure victims, so the difference may reflect both time and scope. The two numbers come from different sources and should not be read as one consistent trend line.
Sources also differ slightly on when the group started. CISA dates SafePay's activity to August 2024. FortiGuard says it "first emerged in late 2024."
Third-party tracking backs up the advisory's description of a group at high tempo. Infosecurity Magazine cites a BlacKite report that ranked SafePay the third most active ransomware group in the first four months of 2026, with a focus on Germany. It also cites NCC Group, which named SafePay the most active group in May 2026 with 70 claimed attacks. Leak-site monitoring summarized by Security Arsenal recorded a single-day wave of 10 new listings on October 5, 2026. Those listings covered organizations in the Czech Republic, Switzerland, Germany, Italy, the US, Chile, Slovakia, Kenya and the Netherlands. Security Arsenal stresses that these are unverified claims by the gang, not confirmed breaches.
One of those listings was T-Systems, the Deutsche Telekom IT subsidiary. Cybernews reports that SafePay gave the company two days to negotiate. A Deutsche Telekom spokesperson told Cybernews that the extortion attempts began on October 5, that only a test environment was affected, and that the stolen data was mainly project presentation material, with no sensitive data accessed. The gang's claim and the company's account of how serious the breach was do not agree, and neither has been independently verified.
What Was Taken
The advisory describes a double-extortion model. SafePay steals data, encrypts systems, threatens to publish what it stole, and in some cases phones victims directly. FortiGuard also notes the use of phone calls as a pressure tactic. The advisory does not give a total volume of data stolen across all victims.
Conduent is the clearest example of what a SafePay breach can expose:
- Scale: HIPAA Journal reports that Conduent's forensic investigation found the personal and protected health information of about 62.2 million people was stolen. That makes it the largest healthcare data breach reported in 2025 and the third largest ever.
- Volume claimed: SafePay claimed it exfiltrated 8.5 TB of data.
- Data types: names, addresses, dates of birth, medical information, health insurance details and Social Security numbers.
- Timeline: Accounts differ. HIPAA Journal says the attacker first got in on October 21, 2024 and kept access until January 13, 2025. Infosecurity Magazine calls it a "November 2024" attack.
- Litigation: An $80 million settlement has been proposed in In Re Conduent Business Services Data Breach Litigation (D.N.J.). HIPAA Journal reported the proposal on October 20, 2026. Infosecurity Magazine dates Conduent's agreement to October 16, 2026. Conduent denies wrongdoing.
Infosecurity Magazine says SafePay is "believed to be behind" the Conduent attack. HIPAA Journal states that SafePay claimed the attack. The advisory itself does not name individual victims.
Why It Matters
A count of 600+ victims from a group active for about two years puts SafePay among the most damaging operations now running. Several points matter for defenders:
- Operating model is disputed. FortiGuard says SafePay is a closed group that writes its own ransomware and runs its own intrusions without affiliates, unlike most ransomware-as-a-service operations. A closed model usually means more consistent tradecraft, which makes detection more transferable from one incident to the next.
- Lineage is unclear. Infosecurity Magazine says SafePay may be a rebrand of LockBit, ALPHV/BlackCat and INC Ransomware. Cybernews says researchers link it to the Conti lineage but that "confidence levels vary." None of this is confirmed, so treat any attribution to older brands as speculative.
- Origin indicators. FortiGuard reports that the payload stops running on systems set to languages associated with former Soviet states. That is a common sign of Eastern European operators.
- Recovery sabotage. The advisory warns that SafePay deletes shadow copies and resets network-attached storage devices that hold backups. Organizations that rely on online backups for resilience are directly exposed.
The Attack Technique
According to the advisory, SafePay gets initial access through:
- Credential abuse: exposed credentials, brute-force password attacks and phished account profiles.
- VPN access: the agencies specifically flag connections from IP addresses belonging to the VPN provider Mullvad.
- Edge-device exploitation: automated scripts that target internet-exposed systems. The advisory lists five CVEs:
- CVE-2020-3259 and CVE-2023-20269 (Cisco ASA/FTD information disclosure and authentication bypass)
- CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication)
- CVE-2024-40766 (SonicWall SonicOS improper access control)
FortiGuard's profile lists a much longer set of CVEs associated with the group, including CVE-2024-3400, CVE-2024-21762, CVE-2023-4966, CVE-2024-55591 and CVE-2025-53770/53771. CVE-2024-40766 is the only one that appears on both lists. FortiGuard also names initial access brokers and misconfiguration exploitation as entry vectors. These are vendor assessments and are not part of the government advisory.
After getting in, the actors create new accounts or take over existing ones, move laterally using legitimate system tools, identify valuable files, and disable security tools before encrypting. They leave a ransom note demanding cryptocurrency. FortiGuard lists Mimikatz, PowerShell, RClone, FileZilla, ScreenConnect, ShareFinder, QDoor, 7-Zip and WinRAR among the tools it has observed.
What Organizations Should Do
- Patch edge devices first. Prioritize VPNs, firewalls and other edge devices, especially anything on CISA's Known Exploited Vulnerabilities catalog. Confirm that the five CVEs in AA26-293A are remediated, paying close attention to Veeam backup servers and SonicWall and Cisco ASA appliances.
- Enforce phishing-resistant MFA and ICAM controls on all remote access, VPN and administrative accounts. Add brute-force lockout and alert on logins from commercial VPN ranges such as Mullvad.
- Restrict administrative tools and privileges so only the users who need them have them, and apply Zero Trust principles to limit lateral movement after a compromise.
- Harden backups against SafePay's recovery sabotage. Keep offline or immutable copies, segment NAS and backup infrastructure from the production identity plane, and alert on shadow copy deletion.
- Hunt with the published IOCs. Load the AA26-293A STIX JSON/XML into your SIEM and EDR. Look for unexpected RClone, FileZilla or ScreenConnect activity, which can indicate data staging and exfiltration.
- Report incidents to law enforcement. The agencies ask victims to report to the FBI, CISA or their national equivalent, and repeat that paying does not guarantee recovery.
Sources: CISA: SafePay ransomware hit over 600 critical infrastructure orgs | StopRansomware: SafePay Ransomware | $80 Million Settlement Proposed to Resolve Conduent ... | SafePay Has Compromised 600 Critical Infrastructure ... | SafePay ransomware targets T-Systems in alleged breach Cybernews | Threat Actor FortiGuard Labs | SAFEPAY Ransomware: 10 New Leak-Site Listings — Sector Targeting An... | CISA, FBI and Partners Release Joint Cybersecurity Advisory on Safe...