Agencies say SafePay hit at least 600 organizations since 2024
October 21–22 reports add encryption and backup-destruction details, the Conduent $80 million settlement, and third-party rankings from NCC Group and BlacKite.
A US, German and UK advisory says SafePay has breached at least 600 organizations since August 2024 and remains among 2026’s most active ransomware groups.
On October 20, 2026, CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and UK partners issued a joint #StopRansomware advisory on SafePay, based on investigations through August 2026. Since August 2024 the independent group, which does not use affiliates, has targeted businesses and critical infrastructure in North America, South America, Europe and Australia. CISA’s advisory counts at least 600 victims; BleepingComputer and Infosecurity Magazine describe them as critical-infrastructure organizations, while The Record places the 600 in the United States and Europe. Actors steal or guess passwords, phish VPN accounts including via Mullvad, and exploit five listed edge and backup flaws, then steal data, encrypt files and demand cryptocurrency. Agencies urge patching, MFA, least privilege, offline backups and reporting, and say payment does not guarantee recovery.
- Named flaws: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
- CVE-2024-40711 is unauthenticated RCE in Veeam, CVSS 9.8, according to GBHackers.
- Encryption uses ChaCha20 and RSA; files receive the .SafePay extension.
- Operators may delete shadow copies and factory-reset NAS backups.
- Conduent agreed October 16, 2026, to an $80 million settlement over a November 2024 breach.
- NCC Group counted 70 claimed SafePay attacks in May 2026, Infosecurity reports.
Timeline
dated events in the reporting · oldest first- Aug 1, 2024SafePay emerges and begins victim activity. · BleepingComputer
- Nov 1, 2024Conduent breach later tied to an $80 million settlement. · Infosecurity Magazine
- May 1, 2026NCC Group counts 70 claimed SafePay attacks. · Infosecurity Magazine
- Aug 1, 2026Most recent investigated SafePay incident cited by agencies. · The Record
- Oct 16, 2026Conduent agrees to pay $80 million settlement. · Infosecurity Magazine
- Oct 20, 2026Joint #StopRansomware advisory on SafePay published. · CISA Advisories
What each outlet adds
beyond the shared facts- CISA AdvisoriesNames five CVEs, persistence methods, and STIX IOC package AA26-293A.
- The RecordNames Microlise and Conduent and describes leak-site victim geography.
- GBHackersGives CVSS 9.8 for CVE-2024-40711 and lists remote-access tools.
- BleepingComputerSays SafePay has no affiliates and activity runs to August 2026.
- Infosecurity MagazineAdds NCC Group and BlacKite figures and the October 16 settlement date.
Coverage
oldest first · one row per article · UTC- · 5d ago
CISA AdvisoriesFirst report
CISA, FBI detail SafePay ransomware hitting 600+ victims since 2024
Agencies say SafePay uses stolen or guessed passwords, phishing, and five known edge-device flaws, then encrypts files for crypto payment.
- · 5d ago
The Record
FBI says SafePay breached more than 600 organizations since 2024
U.S., German, and U.K. agencies say the gang guesses passwords, phishes, and exploits listed flaws.
- · 4d ago
GBHackers
CISA says SafePay ransomware hit 600+ organizations and wiped backups
The October 20 joint advisory covers activity since August 2024 and five exploited CVEs, including critical CVE-2024-40711.
- · 4d ago
Cyber Security News
SafePay Ransomware Affects 600+ Organizations
SafePay ransomware has compromised at least 600 organizations since August 2024 by exploiting exposed VPNs, remote access and backup servers.
- · 4d ago
BleepingComputer
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Since August 2024 the private group has used stolen or brute-forced credentials, VPN access, phishing, and edge-device flaws, then double-extorted victims.
- · 4d ago
Infosecurity Magazine
CISA says SafePay hit at least 600 critical infrastructure organizations
A US, German and UK advisory says the group, active since August 2024, uses double extortion across four regions.
- · 3d ago
Security Affairs
FBI and CISA warn SafePay hit at least 600 organizations
The independent group uses stolen or brute-forced credentials and VPN access, then steals data and appends .SafePay.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 25% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |