Independent newsroom

Thursday, October 22, 2026

The File

Every claim traces to a primary source. Uncertainty is labeled. Corrections are public.

Safety · Thursday, October 22, 2026

U.S. warns of a ransomware gang that has hit about 600 victims, critical services among them

The File desk · Oct. 22, 2026, 7:45 a.m. ET

Confirmed2 primary sourcesAdded 7:45 a.m. ET, Oct. 22

Status

Confirmed — joint advisory from CISA, the FBI, the U.S. Secret Service and international partners. Official risk: the agencies call SafePay one of the most active ransomware groups of 2026 and urge organizations, including critical infrastructure operators, to act now.
  • Confirmed
    Joint advisory from CISA, the FBI, the U.S. Secret Service and international partners.
  • Confirmed
    Official risk: the agencies call SafePay one of the most active ransomware groups of 2026 and urge organizations, including critical infrastructure operators, to act now.
A ransomware group called SafePay has hit about 600 victims across the Americas, Europe and Australia, U.S. and international agencies warned on Wednesday. 1 The Cybersecurity and Infrastructure Security Agency, the FBI and the Secret Service called it one of the most active ransomware groups of 2026. 1
The group has been at work since August 2024, going after businesses and critical infrastructure, the agencies' advisory says. 2 Its members usually get in by stealing or guessing passwords, tricking employees with phishing emails, or using known holes in firewalls and other security equipment. Once inside, they lock the victim's files and demand payment in cryptocurrency. 2
The agencies urge organizations to patch firewalls and other internet-facing devices, require a second login step, limit who has administrator powers, and keep backups that attackers cannot reach. 12
Why it matters (Estimate). Hospitals, water systems, schools and local governments run on the same kinds of networks this group breaks into, and a locked network can stop their services until it is restored. (Estimate — our reading.) The holes the agencies list already have fixes, which means organizations that patch can close the doors this group uses. 2 Most individual readers have nothing to do; the warning is aimed at the people who run these networks.
The oldest of the five security holes on the agencies' list dates to 2020. 2
How we know

Notes

  1. 1.CISA press release, "CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors," Oct. 21, 2026 — https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical
  2. 2.CISA and partners, Cybersecurity Advisory AA26-293A, "#StopRansomware: SafePay Ransomware," Oct. 20, 2026 — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  3. 3.The advisory, #StopRansomware: SafePay Ransomware (alert code AA26-293A), carries an Oct. 20 release date; CISA's press release announcing it is dated Oct. 21. [1][2]
  4. 4."About 600 victims" is the agencies' figure for all sectors; the agencies do not say how many were critical infrastructure. Some news reports described all 600 as critical infrastructure; this desk follows the official wording. [1]
  5. 5.The five flaws listed are CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. [2]

Primary sources

Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.

  1. Source 1

    CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors

    CISA · October 21, 2026

    SafePay has hit about 600 victims across the Americas, Europe and Australia. CISA, the FBI and the Secret Service called it one of the most active ransomware groups of 2026. The agencies urge organizations, including critical infrastructure operators, to act now. About 600 is the figure for all sectors.

    https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical

  2. Source 2

    #StopRansomware: SafePay Ransomware (AA26-293A)

    CISA and partners · October 20, 2026

    The group has been at work since August 2024, going after businesses and critical infrastructure. Members usually get in by stealing or guessing passwords, phishing, or known holes in firewalls and other security equipment, then lock files and demand cryptocurrency. The five flaws listed are CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. The advisory carries an Oct. 20 release date.

    https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

Ask this story

Answers come only from this story and its sources. Free test: limited questions per day.

0/300