A1_TITLE: SafePay’s four-year run reaches 600 victims and a Conduent-sized toll
Federal and European agencies have now put SafePay on the same footing as the sector’s most prolific extortion brands, publishing operational detail on a crew that has quietly accumulated more than 600 victims since it surfaced in August 2024.
The joint advisory from the FBI, CISA and the Secret Service lands with a painful footnote for hospital administrators. Within two months of its first appearance, SafePay breached Conduent Business Services and walked off with 8.5 TB, a haul that eventually became a 62.2 million-record notification and the third-largest healthcare breach on record. Conduent has separately agreed to an $80M class settlement over the incident.
The access routes are familiar and largely unpatched. Authoring agencies name credential theft and password guessing first, then flaws in the edge infrastructure hospitals rely on: Cisco adaptive security appliances (CVE-2023-20269 and CVE-2020-3259), Veeam backup servers (CVE-2023-27532, CVE-2024-40711) and SonicWall firewalls (CVE-2024-40766).
Once inside, the crew creates fresh accounts or takes over existing ones, maps the network with built-in administration tools, disables protections, encrypts and drops a cryptocurrency ransom note.
For clinical environments the practical exposure sits in the two systems hospitals most often deprioritize: the backup appliance that makes restoration possible and the VPN that admits remote clinicians. A single reused or unmanaged clinician credential can put an attacker behind the firewall with the same view of the EHR a nurse has.
The agencies recommend prioritizing those specific patches, restricting administrative tooling and standing up identity, credential and access management controls with multifactor across every remote path.
