A joint US, German and UK advisory says the SafePay ransomware group has hit at least 600 victims. Here is how it gets in and what to check.
US agencies and their partners abroad have issued a warning about SafePay, a ransomware group that locks up a company's files and demands payment. The advisory says SafePay has been highly active since August 2024 and was among the most active ransomware groups in 2026. It has affected at least 600 separate victims.
The Cybersecurity and Infrastructure Security Agency (CISA) published the advisory on October 20, 2026. The FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit joined it. It draws on investigations as recent as August 2026 and is part of CISA's #StopRansomware effort.
According to the advisory, SafePay usually gets in by stealing or guessing passwords, exploiting weaknesses in security systems, or sending phishing messages. Phishing means tricking someone into handing over login details. The group has also used VPN access, which is a way of connecting to a company network from outside, and a VPN provider called Mullvad to hide where it connects from.
Once inside, the attackers create new accounts or take over existing ones. They then use ordinary tools built into the system to move around, find valuable files and switch off security software. In some cases they changed users' passwords so that real employees could not log in. Finally, they encrypt the files, which makes them unreadable, and leave a ransom note demanding payment in cryptocurrency.
The advisory says SafePay has targeted businesses and critical infrastructure in North America, South America, Europe and Australia. That can include clinics, home-care agencies and nonprofits. The advisory is written for IT and security teams at organizations. It describes attacks on organizations, not on individual home users.
The alert box above lists the practical steps. In short, hand the advisory to whoever runs your IT, and make sure your backups and logins are in better shape than an attacker would expect. The agencies also recommend a longer list of protections in the advisory's Mitigations section.
The advisory includes a downloadable list of technical warning signs, called indicators of compromise, that IT staff can use to check their systems. CISA's stopransomware.gov site collects all of its ransomware advisories and free resources. The material does not say whether SafePay's activity is rising or falling, so the safest assumption is that the group is still active.
Send the CISA advisory to whoever handles your IT and ask them to confirm your backups and logins are ready for a ransomware attack.
Iris Ohyama, the company behind the Iris Plaza online store, says data on up to 7.7 million people may be out. Card numbers were not in the affected service.
Read more: Japanese home goods maker says 7.7 million customers' data may be exposedScammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000
