Federal and international agencies warned on October 20 that SafePay, among the most active ransomware crews of 2026, has now hit at least 600 victims, with healthcare among the sectors in its path.
The joint advisory from CISA, the FBI, the Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK agencies describes an operator active since August 2024 across North and South America, Europe, and Australia, running double extortion: steal data, encrypt systems, then threaten publication and place calls to executives.
SafePay’s access routes are the ones hospital security teams already struggle to close. Actors brute-force passwords, reuse credentials exposed elsewhere, and exploit edge devices, including the Cisco ASA flaws CVE-2023-20269 and CVE-2020-3259, Veeam Backup & Replication bugs CVE-2023-27532 and CVE-2024-40711, and SonicWall SonicOS CVE-2024-40766.
They also ride Mullvad VPN addresses using phished account profiles. Once inside, they create or hijack accounts, use built-in tools for reconnaissance and exfiltration, disable defenses, encrypt, and drop notes.
The warning lands weeks after MedRisk reported SafePay’s four-year run reaching the 600-victim mark, and it carries a healthcare-heavy precedent: the group hit Conduent Business Services two months after emerging, exfiltrating 8.5 TB in an incident eventually reported as affecting 62.2 million people, the third-largest U.S. healthcare breach on record.
Defenders should patch the five listed flaws first, retire local-admin sprawl, enforce MFA on VPN and remote access, and monitor for backup console logins from unexpected hosts.
