MediumII Cyber Warfare & Critical Infrastructure20 October 2026, Tuesday
US and European police tie 600 victims to SafePay ransomware
On 20 October CISA, the FBI and the Secret Service issued joint advisory AA26-293A with German and British police. SafePay has hit at least 600 victims since August 2024 and deletes backups before encrypting systems.
The US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the Secret Service published joint advisory AA26-293A on SafePay ransomware on 20 October. Agencies from 2 European countries joined in: the Rhineland-Palatinate state criminal police office in Germany, and the National Crime Agency and a regional organised crime unit in the UK. The document says the group has hit at least 600 separate victims across North and South America, Europe and Australia since August 2024.
CISA classifies the group's method as T1490, the technique of inhibiting system recovery, and sets out 3 steps. Operators stopped the Windows shadow copy service and reset the network-attached storage devices holding backups to factory settings. In some cases they deleted all backups before ransom talks began. The advisory lists 5 vulnerabilities as initial access routes, including CVE-2024-40766, which affects SonicWall firewalls, and CVE-2024-40711, rated 9.8 on CVSS.
According to Cybersecurity Dive, security firm Halcyon says the group has targeted 15–30 organisations a month in 2026, with attack volume peaking in late 2025. The same report says the July 2025 attack on Ingram Micro disrupted order processing for days and exposed the personal data of more than 42,000 people. The advisory recommends multi-factor authentication on VPN accounts and encrypted, immutable, offline backups. It gives no sector breakdown, saying only that the 600 victims span several critical infrastructure sectors.
Talay assessment
Bottom line
The SafePay advisory documents a shift in ransomware competition from encryption towards blocking recovery. Once backups are deleted, bargaining power passes to the attacker. All 5 listed vulnerabilities date from 2020–2024, so the attacks rely on unpatched VPNs and firewalls rather than zero-days. The joint signature of German and British police confirms the group runs the same infrastructure on both sides of the Atlantic.
Likely effects
- Cyber insuranceNegative1–6 months
Deleting backups before talks lengthens recovery and raises pressure to pay; insurers may tighten offline-backup requirements in policies.
- Critical infrastructureNegativeWeeks
With at least 600 victims across several critical infrastructure sectors, old VPN and firewall flaws remain the main way in.
- Supply chainNegative1–6 months
At Ingram Micro, order processing was disrupted for days; a single incident at distributor level can spread to thousands of downstream customers.
Possibilities, ranked
- 1Activity continues at the same pace55%
The group keeps targeting 15–30 organisations a month, and new victims appear on its leak site.
Watch: November SafePay victim counts from Halcyon and similar trackers
- 2Activity falls after the advisory30%
Wider circulation of the IOC list and patching campaigns narrow the group's access routes.
Watch: A fall in internet-exposed devices vulnerable to CVE-2024-40766 and CVE-2024-40711
- 3A major new supply chain incident15%
The group hits a distributor like Ingram Micro, and operational disruption spreads across several sectors.
Watch: A new incident attributed to SafePay in SEC 8-K filings
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Confirmed victims▲ 600+
- Monthly targets in 2026 (Halcyon)▲ 15–30
- Listed vulnerabilities▲ 5