Short answer: SafePay ransomware is a criminal group that breaks into business networks, usually through stolen or guessed passwords, VPN access and unpatched internet-facing devices, copies data out, then encrypts files and demands payment. According to CISA advisory AA26-293A (published October 20, 2026), it has hit at least 600 victims since August 2024. The best defences for a 5 to 50 person company are boring and affordable: multi-factor authentication, patching, tested offline backups and fewer admin accounts.
Last reviewed: October 25, 2026.
Key takeaways
- CISA, the FBI and partner agencies say SafePay has been active since August 2024 and has impacted at least 600 separate victims.
- Entry is mostly through weak points small firms also have: reused or guessed passwords, VPN logins without MFA, and old vulnerable edge devices.
- SafePay steals data first, so restoring from backup does not end the problem. Leaked data is a separate risk.
- Attackers go after backups, including network-attached storage, so you need an offline or immutable copy and a restore test.
- If you are hit, isolate first, preserve evidence, report to the right authority, and think carefully before paying. Agencies do not encourage payment.
What is SafePay ransomware, in plain English?
SafePay is a ransomware group. Ransomware is software that locks your files so you cannot open them, while the criminals demand money for the key. SafePay also practises "double extortion": it copies your files to its own storage before locking them, then threatens to publish them if you do not pay.
According to the CISA advisory (fetched October 25, 2026), the group targets businesses and critical infrastructure in North America, South America, Europe and Australia. The advisory was written by the FBI, CISA, the U.S. Secret Service and law enforcement partners in Germany and the United Kingdom. If you want the basics first, see our guide to what ransomware is.
How SafePay gets in, according to CISA
The advisory lists several entry routes. None of them require movie-style hacking. Most come down to doors that were left unlocked.
| Entry route (per CISA) | What it means for a small business |
|---|---|
| Stolen, phished or brute-forced credentials | A staff password reused from another site, or guessed repeatedly, is enough. |
| VPN access, including phished account profiles | A VPN login with only a password is a front door with a weak lock. |
| Exploited edge-device vulnerabilities | Firewalls, VPN appliances and backup servers that are not updated. Check the advisory for the exact list of vulnerabilities it names. |
| Phishing | A convincing email gets a password or a download. |
For a related real-world example of password attacks against VPNs, read our article on the SonicWall VPN credential stuffing attack.
What SafePay does once inside
CISA describes a fairly standard but thorough routine. Understanding it shows why each checklist step below matters.
- Gets admin rights. It uses existing admin accounts or creates new ones, using tools already built into Windows.
- Turns off security software. The advisory says actors disable security tools and sometimes change user passwords so people cannot log in.
- Maps your file shares. It runs scripts that list network shares to find valuable data.
- Moves sideways. It uses Remote Desktop, PsExec, Windows Remote Management and remote management software. The advisory also notes tools such as ScreenConnect, AnyDesk and TeamViewer being used for persistence or file transfer. These are legitimate products, so their presence alone is not proof of an attack, but unexpected installs deserve a look.
- Steals data. It compresses files and uploads them using tools such as RClone, WinSCP, FileZilla and cloud storage accounts.
- Destroys recovery options. According to CISA, it stops the Volume Shadow Copy Service, resets network-attached storage holding backups to factory settings, and in some cases deleted all network-attached backups.
- Encrypts and extorts. Files get a
.SafePayextension. A ransom note points to a Tor chat site, the demand is usually a share of company revenue in cryptocurrency, and victims may get phone calls. Unpaid victims have data posted on a leak site.
12-step protection checklist mapped to CISA's mitigations
Every step below traces to a mitigation in AA26-293A. Do them in this order if you can: the first five close the most common doors. Back up important files before changing settings.
Steps 1 to 4: lock the doors
- Turn on MFA for VPN, remote access and webmail. CISA recommends MFA for all services where possible, especially webmail, VPNs and accounts that reach critical systems. Prefer an authenticator app or passkey over SMS. See our MFA guide for business owners and our explainer on passkeys.
- Patch internet-facing devices first. Firewalls, VPN gateways, routers and backup servers are the priority. CISA says to keep operating systems, software and firmware current, starting with known exploited vulnerabilities. Check each vendor's support page for firmware updates, and retire devices that no longer receive them.
- Use unique, long passwords. CISA points to 15 to 64 character passwords, no reuse, and password managers. A password manager makes this realistic for staff.
- Lock out repeated guessing. Enable account lockout after several failed sign-ins on your VPN, Microsoft 365 or Google Workspace and Windows accounts. This directly blunts brute-force attacks.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
Steps 5 to 8: limit the damage if someone gets in
- Cut down admin accounts. CISA advises auditing admin accounts and applying least privilege. In a small office, most people should use a standard account for daily work. Keep one or two named admin accounts, used only when needed.
- Disable unused remote access. Close Remote Desktop exposed to the internet, remove old VPN profiles of former staff, and uninstall remote tools nobody can explain. CISA also suggests blocking unknown outside sources from reaching internal remote services and disabling unused ports.
- Keep offline or immutable backups. CISA recommends offline, encrypted, immutable backups covering your whole environment, in separate locations. Because SafePay reportedly wiped network-attached backups, a NAS sitting on the same network is not enough by itself. Cloud backup with immutability or a disconnected drive rotation fits most small firms. See our cloud backup page.
- Test a restore. CISA specifically says to test restoration regularly. Once a quarter, restore a real folder and a real application to a spare machine and time it. A backup you have never restored is a hope, not a plan.
Steps 9 to 12: notice and recover faster
- Turn on logging and monitoring. CISA recommends network monitoring that logs lateral movement and notes that endpoint detection tools help. At minimum, keep sign-in logs for VPN, email and servers for several months and know who reviews them.
- Review accounts and software. Look for new, inactive or unrecognised accounts and unexpected remote tools. Remove what you cannot explain.
- Segment the network. Keep guest Wi-Fi, cameras, printers and backup storage away from the main office network where practical. This limits lateral movement.
- Train staff on phishing basics. Teach three habits: check the sender and link before clicking, never approve an MFA prompt you did not trigger, and report anything odd without fear of blame. CISA also suggests banners that mark external email.
Want a technician to walk through these twelve steps with you? Our remote technicians can review your setup over a secure session, and our Windows support covers patching and account cleanup. Related reading: October 2026 Patch Tuesday.
If you are hit: the first hour
CISA's incident response advice for a detected compromise with nothing yet encrypted starts with isolating affected systems, scoping the intrusion, reporting it, and hardening. If files are already encrypted, CISA points to the Ransomware and Data Extortion Response Checklist in its #StopRansomware Guide. Our own 24-hour ransomware guide goes deeper.
- Isolate. Unplug affected computers from the network and Wi-Fi. Do not shut them down if you can avoid it, since memory may hold evidence. Disconnect backup drives and NAS devices too.
- Do not delete anything and do not wipe machines yet. Photograph the ransom note. Keep logs, the note and any suspicious files.
- Use a different device and channel. Assume email and chat may be watched. Call people instead.
- Change passwords from a clean device, starting with admin, VPN and email accounts, and revoke active sessions.
- Report it. See the table below.
- Call your insurer, lawyer and IT provider before any contact with the criminals.
| Country | Where to report |
|---|---|
| United States | FBI Internet Crime Complaint Center (IC3), a local FBI field office, or CISA's incident reporting system (per the advisory). |
| Canada | Your local police for emergencies, and the Canadian Centre for Cyber Security reporting form (choose "An Organization"). The Canadian Anti-Fraud Centre also takes fraud reports. Confirm current steps on cyber.gc.ca. |
| United Kingdom | Report Fraud (reportfraud.police.uk) or local police on 101, per the advisory. The NCSC also provides incident guidance. |
| Australia | The Australian Cyber Security Centre accepts reports through ReportCyber on cyber.gov.au. Confirm current steps on that site. |
Reporting is voluntary, according to CISA, and should follow applicable law. Privacy rules may also require you to notify customers or regulators if personal data was taken, so ask a lawyer.
What not to do
- Do not pay in a panic. CISA says agencies do not encourage payment: it does not guarantee recovery, may encourage more attacks and may fund illegal activity. Get advice first.
- Do not reboot, reformat or reinstall before evidence is saved.
- Do not trust a restored backup until you are sure the intruder is out, or you may restore the problem.
- Do not contact the criminals from your own network or promise anything.
- Do not tell staff or customers nothing. Honest, calm communication matters.
Frequently asked questions
What is SafePay ransomware?
It is a ransomware group that steals data and encrypts files, then demands payment, usually a share of revenue in cryptocurrency. CISA says it has been active since August 2024.
How many victims has SafePay claimed?
CISA advisory AA26-293A states at least 600 separate victims across multiple critical infrastructure sectors, as of its October 20, 2026 publication.
How does SafePay get into networks?
According to CISA, through stolen or brute-forced credentials, VPN access, exploited vulnerabilities in internet-facing devices, and phishing.
What file extension does SafePay use?
CISA says encrypted files are appended with .SafePay. A ransom note directs victims to a Tor chat portal.
Will MFA alone stop SafePay?
No single control stops it. MFA on VPN and webmail closes the most common door, but you still need patching, tested backups and limited admin rights.
Should a small business pay the ransom?
Agencies do not encourage payment. It does not guarantee recovery. Speak to your insurer, a lawyer and a response professional before deciding.
Are my backups safe from SafePay?
Only if at least one copy is offline or immutable. CISA reports that actors reset network-attached backup storage and deleted network-attached backups in some cases.
Where do I report a SafePay attack in Canada?
Use the Canadian Centre for Cyber Security's reporting form and your local police. Check cyber.gc.ca for the current route.