CISA and FBI Warn of SafePay Ransomware Breach Affecting Over 600 Critical Infrastructure Organizations

According to a joint CISA-FBI advisory published on October 21, 2026, the SafePay ransomware operation has compromised over 600 critical infrastructure entities globally since 2024. The advisory notes that the gang has targeted organizations across essential services sectors, though specific industry verticals were not detailed in the public summary. The FBI and CISA have not disclosed the initial access vectors used in the campaign, stating only that the group employs typical ransomware tactics. The advisory urges organizations to review their security posture, ensure robust backup procedures, and implement recommended mitigations to reduce the risk of compromise. No specific software vulnerability or patch was identified, as the breach is attributed to ransomware deployment rather than exploitation of a single CVE. The true scope of the campaign, including the exact number of affected organizations and the specific sectors targeted, remains subject to verification through official government channels.