US, UK and German agencies warn that SafePay ransomware, which has hit more than 600 organizations, gets in through weak logins and old, unpatched business gear.
Government agencies in the US, UK and Germany have issued a joint warning about SafePay, a ransomware gang that has hit more than 600 organizations since it appeared in August 2024. The gang mostly gets in through weak passwords and security holes in common business equipment that was never updated.
The warning comes from the US Cybersecurity and Infrastructure Security Agency, the FBI, the Secret Service, and cybersecurity agencies in Germany and the United Kingdom. It targets businesses and critical infrastructure in North and South America, Europe and Australia.
SafePay uses what is called double extortion. First it steals a copy of your data. Then it locks your files with ransomware, which is software that scrambles them. It demands payment to unlock the files and to keep the stolen data from being posted online.
Two months after the group was first identified, it attacked Conduent Business Services, a US business service provider. SafePay took 8.5 terabytes of data. Conduent reported that 62.2 million people were affected, making it the third-largest US healthcare data breach of all time. The agencies now call SafePay one of the most prolific ransomware groups.
The advisory lists several ways in. Some are simple, such as guessing passwords over and over or using logins that have already leaked. Others use known flaws in equipment that sits at the edge of a company network, like firewalls and backup systems. The flaws are named in the advisory by catalog numbers. Products named include:
Phishing means tricking someone with a fake message. Once inside, the attackers take over existing accounts or create new ones. They use normal system tools to steal logins, look around the network and copy files. Then they switch off security protections, lock the files and leave ransom notes.
Any business using the products above should treat this as urgent, and healthcare organizations are specifically named among the targets. If you do not use that gear, those particular flaws do not apply to you. Weak or reused passwords are still an open door for any business.
The steps in the alert box above cover the basics. The agencies stress regular updates, tighter control over who has administrator power, and multifactor authentication, which asks for a second proof of identity beyond a password. Send the full advisory to whoever manages your IT.
The advisory also lists technical warning signs, called indicators of compromise, that IT staff can check for in their systems. The material does not say whether the attacks are slowing down. The agencies describe the group as still accelerating.
Update your Cisco, Veeam and SonicWall gear and turn on multifactor authentication, because SafePay is walking in through unpatched devices and weak logins.
A message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
