# CISA and Partners Warn of SafePay Ransomware

In October 2026, CISA, the FBI, the U.S. Secret Service, and international cybersecurity partners issued a joint advisory describing SafePay ransomware activity that has affected more than 600 organizations worldwide since August 2024, including critical infrastructure operators. The advisory recommends urgently patching cited vulnerabilities—including those affecting Cisco, Veeam, and SonicWall products—and strengthening remote access controls, multifactor authentication, privileged access, network segmentation, and offline backups. It announces no solicitation, contract award, funding, or new statutory procurement requirement; its relevance to contractors is as a security-planning signal and an indicator of potential demand for cyber defense, incident response, and resilience services.

- Contractors supporting government and critical-infrastructure networks can use the advisory’s tactics, indicators of compromise, and mitigations to review exposure, patch affected systems, and assess access and backup protections.
- Organizations handling sensitive environments should evaluate multifactor authentication, least privilege, network segmentation, and protected offline backups as part of their security and resilience planning.
- Cybersecurity and incident-response providers may find increased customer demand for vulnerability remediation, forensic triage, and resilient-backup services, but the advisory does not guarantee funding or identify a procurement opportunity.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 24, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Federal Bureau of Investigation (FBI)
- United States Secret Service (USSS)
- German cybersecurity agencies
- United Kingdom cybersecurity agencies

### Key Quotes
> With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.
> — Chris Butera, Acting Executive Assistant Director for Cybersecurity, CISA

### Sources
- [CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors | CISA](https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical) - CISA
- [Feds Issues Advisory About SafePay Ransomware Group](https://www.hipaajournal.com/feds-issues-advisory-about-safepay-ransomware-group) - The HIPAA Journal
- [CISA, FBI, Secret Service Detail SafePay Ransomware Tactics](https://www.executivegov.com/articles/cisa-fbi-secret-service-safepay-ransomware-advisory) - ExecutiveGov