Agencies Put a Confirmed Number to the SafePay Ransomware Operation
Six law enforcement and cybersecurity agencies in three countries have published a joint advisory on the SafePay ransomware operation, reporting that the group has impacted at least 600 separate victims since August 2024.
The advisory, released Oct. 20, 2026, and numbered AA26-293A, carries the names of the FBI, the Cybersecurity and Infrastructure Security Agency, the United States Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and the United Kingdom's North West Regional Organised Crime Unit. The agencies say they published it to hand network defenders the methods and warning signs their own investigators recorded, and the first action on their list is regular patching of firewalls and other edge devices.
The agencies report that SafePay got its initial access through five vulnerabilities that were already publicly known, all of them in edge-device products, with identifiers issued between 2020 and 2024: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. Stolen or guessed passwords and phishing are listed alongside them.
The advisory says at least 600 separate victims, from multiple critical infrastructure sectors, and places them in North America, South America, Europe and Australia. The agencies base the count on investigations running as recently as August 2026, and they call SafePay one of the most active ransomware groups of 2026.
Alongside patching, the advisory asks organizations to require multifactor authentication for as many services as possible, to limit administrative tools and privileges to the people who need them, and to keep offline, encrypted backups and test that they restore.
It was published as part of #StopRansomware, a continuing series in which the agencies document individual ransomware variants and the groups behind them.
