SafePay breaches have reached over 600 critical-infrastructure organizations, CISA warns
SecurityUnverifiedUpdated:
A joint advisory attributed to CISA and partner agencies says the ransomware group has affected organizations in North America, South America, Europe, and Australia; the underlying claims have not been independently verified.
An advisory quantifies breaches since 2024
CISA says SafePay breached more than 600 critical-infrastructure organizations worldwide since 2024. The joint advisory describes reported initial-access methods including exposed credentials, password attacks, VPN access, phishing, and exploitation of internet-exposed systems, and includes indicators and tactics tied to prior activity.
The supplied material provides no earlier, comparable count of critical-infrastructure organizations affected by SafePay.
The advisory newly puts the reported total at at least 600 organizations across multiple critical-infrastructure sectors since August 2024, and says related activity was observed through August 2026.
Initial-access methods paired with defensive measures
The advisory provides a newly quantified reported scope for SafePay activity while pairing it with defensive measures for network defenders, including multifactor authentication, access controls, and updates for VPNs, firewalls, and other edge devices.
Sources
- BleepingComputerCISA: SafePay ransomware hit over 600 critical infrastructure orgsRead source →