# CISA says SafePay breached over 600 critical infrastructure organizations

_Published Wednesday, October 21, 2026 at 5:07 AM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![CISA says SafePay breached over 600 critical infrastructure organizations — Primary](https://www.bleepstatic.com/content/hl-images/2026/08/11/Hacker.jpg)

CISA says SafePay ransomware has breached over 600 critical infrastructure organizations worldwide since 2024. A joint advisory with U.S., German and UK law enforcement agencies includes indicators of compromise and attack techniques observed during investigations between November 2024 and August 2026.

The group gains access through exposed credentials, brute force password attacks and vulnerable internet-facing systems. It steals documents before encrypting systems and may disrupt recovery by deleting shadow copies and resetting storage devices containing backups. The agencies recommend restricting administrative privileges, enabling multifactor authentication and patching vulnerable edge devices; paying a ransom does not guarantee file recovery.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/)

---
Canonical: https://techandbusiness.org/newswire/MKxo0wODHC9K7kNVu8zaS4
Published: 2026-10-21T09:07:13.913Z
Story chronology: 2026-10-21T08:36:24.000Z
Retrieved: 2026-10-25T06:21:21.390Z
Publisher: Tech & Business (techandbusiness.org)