Zero Radar
← feed
HighSecurity incidentupdated 27 Oct 2026, 18:35 UTC

SafePay ransomware gang has hit over 600 organizations

A criminal group called SafePay locks up company computers and files, then demands payment to unlock them. Law enforcement says they have hit at least 600 organizations since August 2024.

Attacks reported (DataBreaches.net)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy DataBreaches.net, not officially confirmed yet
What to doCheck exposureVerify that you have tested, offline backups and enable multi-factor authentication on remote access accounts.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

What happened

Law enforcement agencies including the FBI, Germany, and the UK issued an advisory describing SafePay as an active ransomware group that has breached at least 600 organizations in the U.S. and Europe since August 2024.

Why it is dangerous: Any organization, especially those in the U.S. and Europe, can have its data encrypted and stolen, causing downtime and possible extortion; the advisory indicates the group is among the most active ransomware operators.

Are you affected?

You are affected if your organization runs systems in the U.S. or Europe that could be targeted by SafePay ransomware; the material does not name specific products, versions, or configurations.

What to do

  1. Read the joint advisory from the FBI and partner agencies for SafePay indicators of compromise and recommended defenses
  2. Confirm that offline, tested backups exist and are isolated from your main network
  3. Review access controls and enable multi-factor authentication on remote and administrative accounts
  4. Prepare an incident response plan and know who to contact, including law enforcement

Timeline

  1. 27 Oct 2026, 18:19 UTC
    Publicly disclosed
  2. 27 Oct 2026, 18:19 UTC
    Reported by DataBreaches.net · DataBreaches.net
  3. 27 Oct 2026, 18:35 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-70d7eeb6
Disclosed
27 Oct 2026, 18:19 UTC
On Zero Radar
27 Oct 2026, 18:35 UTC (16 min after disclosure)
Last change
27 Oct 2026, 18:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SafePay ransomware gang has hit over 600 organizations · Zero Radar