US and UK agencies warn of SafePay ransomware

On October 21, 2026 CISA, the FBI, the US Secret Service and international partners warned organisations about the SafePay ransomware group. CISA is the US Cybersecurity and Infrastructure Security Agency. Their joint advisory says the group has hit at least 600 victims in several critical infrastructure sectors.

SafePay has hit at least 600 victims since August 2024

The advisory calls SafePay one of the most active ransomware groups in 2026. The group has been highly active since August 2024. It targets businesses and critical infrastructure in North America, South America, Europe and Australia.

The advisory, alert code AA26-293A, is dated October 20, 2026. Its authors include the UK's National Crime Agency and the North West Regional Organised Crime Unit. They wrote it with the FBI, CISA, the US Secret Service and Germany's Landeskriminalamt Rheinland-Pfalz.

The group gets in through stolen passwords and unpatched devices

SafePay gets into networks with stolen or compromised passwords and known flaws in devices that face the internet, often through VPN services. Once inside, it uses ordinary IT tools to move around and deletes or disables backups, so recovery is harder. In some cases it deleted every backup on the network.

It then steals data and locks systems. It threatens to publish the data and, in some cases, telephones the victim. If the victim does not pay, it posts the data on its leak website.

Chris Butera of CISA said public-facing devices with known flaws continue to be frequently targeted by groups like SafePay.

For smaller firms, the advice is the basics done well

The advisory names small and medium businesses among its audiences. Its advice is not specialist. It is the everyday work of keeping systems patched and accounts secure.

The agencies urge organisations to keep all systems and software up to date, starting with devices that face the internet, such as firewalls. They also urge multifactor sign-in, offline backups that are tested, and networks split into sections so ransomware cannot spread.

The defences the agencies urge against SafePay

Keep operating systems, software and firmware up to date
Patch firewalls and other devices that face the internet first
Require multifactor authentication
Keep offline backups and test that you can restore them
Split the network into sections so ransomware cannot spread

A summary of the mitigations in the CISA press release and the joint advisory. It is general information, not advice for one network.

US and UK agencies do not encourage paying the ransom

Many firms ask whether anyone has paid a ransomware group, and what happened. The authoring agencies do not encourage payment, because paying does not guarantee the files come back.

The UK's National Crime Agency says the same. It calls ransomware the greatest cyber serious and organised crime threat to the UK. It says UK law enforcement does not encourage, endorse nor condone ransom payments.

More #StopRansomware advisories will follow

The SafePay advisory is part of an ongoing #StopRansomware series. In it, the agencies publish advisories for network defenders about ransomware groups and their methods.

Sources

cisa.gov, CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors, CISA, checked 22 October 2026
cisa.gov, #StopRansomware: SafePay Ransomware, CISA, checked 22 October 2026
nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency, checked 22 October 2026

This is an independent editorial guide, not legal advice.