Summary
- A joint international advisory records at least 600 organisations affected by SafePay since August 2024.
- Investigators identify compromised credentials, exposed VPN services, known vulnerabilities and interference with backups among the group's methods.
- British and German law enforcement helped develop the advisory, which covers victims across Europe and several other regions.
US, British and German cybersecurity and law enforcement authorities have published a joint advisory documenting at least 600 organisations affected by SafePay ransomware, including businesses and critical infrastructure operators across Europe and other regions.
The warning, issued on 20 October by the US Cybersecurity and Infrastructure Security Agency and its partners, describes the group’s use of compromised credentials, exposed network services and previously disclosed vulnerabilities to gain access to organisations.
Investigators also describe efforts to damage recovery capabilities, including deleting Windows shadow copies and resetting storage devices containing backups.
SafePay has operated since at least August 2024 and was among the most active ransomware groups in 2026, according to the agencies. The minimum of 600 affected organisations covers multiple critical infrastructure sectors and several regions; it is not a count of UK victims or an estimate of the number of people whose information was exposed.
Access through accounts and exposed infrastructure
The advisory identifies several routes through which SafePay operators have entered victim networks, rather than attributing every incident to a single vulnerability or compromised supplier.
Some investigations uncovered the use of exposed account credentials and password guessing against remote access services. Others identified phishing activity that enabled attackers to use existing accounts.
The agencies also recorded exploitation of known vulnerabilities affecting internet-facing devices and software. Products implicated in their investigations include Cisco network security appliances, SonicWall systems and Veeam Backup & Replication.
These weaknesses had been disclosed before the October SafePay advisory. Their appearance in the investigators’ findings reflects continued exposure where systems have not received applicable corrections or where other access conditions remain available.
The existence of a vulnerable product does not prove that it was the entry point in every SafePay incident. The investigators describe several observed methods across different environments.
VPN access also features in the advisory. The agencies identify connections associated with Mullvad, a commercial VPN provider, in activity linked to the group.
A connection originating from a privacy service is not inherently malicious. Its significance depends on the account involved, the surrounding authentication records and the actions performed after access was established.
Once inside a network, attackers may use legitimate administrative facilities to locate systems, examine permissions and move between resources. The same tools can support ordinary maintenance, making the identity and context associated with their use important to an investigation.
Recovery systems targeted during intrusions
SafePay’s activity extends beyond encrypting production files. The advisory documents attempts to interfere with the systems and copies an organisation might otherwise use to recover.
Investigators observed deletion of Windows shadow copies, which can retain previous versions of files and system data. They also identified resets of network-attached storage devices containing backup material.
Those actions can increase the difficulty of restoring systems after ransomware has rendered operational data or applications unavailable.
The impact depends on how backups are organised. Deleting one set of shadow copies does not establish that every independent backup has been destroyed, while interfering with shared recovery infrastructure can affect several services at once.
Backup protection therefore has a separate identity and privilege dimension. An attacker who gains control of an account permitted to change backup configurations may be able to weaken recovery arrangements before deploying encryption.
In some organisations, backup administration uses service accounts, dedicated management consoles or storage systems whose permissions differ from those on production servers.
Where those boundaries are insufficiently separated, the compromise of a privileged identity can expose both operational systems and the means of recovering them.
That creates two linked but distinct consequences: an interruption to normal activity and a reduction in the organisation’s ability to restore service within its planned recovery period.
Data theft creates separate consequences from encryption
The agencies describe SafePay as operating a double-extortion model in which attackers steal information and then encrypt systems, threatening publication of the stolen material to increase pressure on victims.
Some investigations also identified direct telephone contact with affected organisations.
That approach can leave a victim facing confidentiality concerns even after encrypted applications have been successfully restored.
Whether personal information was actually taken must be established from the evidence associated with an individual incident. A criminal group’s claim to possess a particular dataset is not sufficient on its own to determine the records accessed or removed.
Where an investigation confirms exposure of personal information, European organisations may need to consider data protection notification requirements alongside obligations arising from disruption to regulated services.
The applicable reporting frameworks depend on the organisation, affected systems and the nature of the incident. A ransomware event is not automatically a reportable personal data breach, just as restoration of encrypted systems does not resolve a proven data disclosure.
The advisory’s technical indicators and investigative findings can assist in identifying known SafePay activity, but they do not replace an assessment of what occurred within a particular organisation.
European authorities contribute to joint investigation
The advisory was prepared by CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency and the North West Regional Organised Crime Unit.
It draws on investigations conducted by US and German authorities as recently as August 2026, consolidating information about techniques and indicators observed in different incidents.
SafePay activity has affected organisations in North America, South America, Europe and Australia. The agencies do not provide a verified national breakdown supporting a separate UK victim total.
The joint recommendations reflect the routes identified in those investigations. They include timely remediation of known vulnerabilities affecting exposed devices, stronger account and identity controls, multifactor authentication and restrictions on administrative privileges.
Those measures address different stages of the group’s activity. Correcting an edge-device vulnerability does not invalidate credentials that have already been compromised, while strengthening login controls does not necessarily protect backup administration from an attacker who already holds privileged access.
The agencies also encourage incident reporting and caution that paying a ransom does not guarantee that encrypted information will be recovered or stolen material withheld.
The 20 October advisory provides a common investigative and defensive reference for a ransomware operation with a documented international footprint. Its minimum victim count remains an aggregate across sectors and jurisdictions, while the consequences and access methods of individual cases require separate evidence.
