SafePay Ransomware Advisory: What PE Portfolios Should Check
CISA, FBI and partners flagged SafePay ransomware tactics. What PE operating partners and portfolio CFOs should verify on VPNs, MFA, patching and backups.
A joint advisory from CISA, the FBI, the U.S. Secret Service and international partners describes SafePay as one of the most active ransomware groups in 2026. The group breaks in through compromised credentials and vulnerable internet-facing devices, then disables backups before stealing and encrypting data. Portfolio companies that run VPNs or other exposed remote-access gear should confirm their patch status, multifactor coverage, backup isolation and signs of compromise, and the results should come from company evidence rather than assumptions.
What changed with the SafePay ransomware advisory?
On October 21, 2026, CISA, the FBI, the U.S. Secret Service and international partners released a joint #StopRansomware advisory on SafePay ransomware.
The CISA press release announcing the advisory is dated October 21, 2026. That date marks the announcement. It is not necessarily the date of any specific intrusion.
The agencies describe SafePay as one of the most active ransomware groups in 2026, with approximately 600 victims across sectors in the Americas, Europe and Australia.
The FBI stated that SafePay actors have targeted more than 600 victims worldwide across multiple critical infrastructure sectors.
The advisory provides observed tactics, techniques and procedures, indicators of compromise and recommended mitigations.
How do SafePay ransomware actors get in and cause damage?
According to the advisory announcement, SafePay actors gain access by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through VPN services.
Once inside, they use legitimate IT tools to move through networks and delete or disable backups to undermine recovery.
They then steal data, encrypt systems and pressure victims to pay by threatening to publish stolen information, in some cases calling victims directly.
Which portfolio companies should treat the SafePay advisory as relevant?
Our analysis: the advisory matters most for companies with one or more of these conditions:
- VPN or other remote-access appliances exposed to the internet.
- Multifactor authentication that does not cover all remote access.
- Backups that are reachable from the production network or have not been restored in a test.
- Flat networks where one compromised account can reach most systems.
In our view, operating partners should use this advisory to request the same short evidence set from each affected company, which supports consistent PE portfolio-level oversight. For assets still in diligence, the same questions fit a deal-team evidence request. For recently closed assets, they belong in the first-100-days cyber plan.
What should SafePay change in remediation and funding decisions?
The recommended mitigations include keeping operating systems, software and firmware up to date, requiring multifactor authentication, prioritizing patching of known exploited vulnerabilities in internet-facing systems, maintaining offline backups with regular restoration testing, and segmenting networks.
CISA also encouraged organizations to urgently patch the known exploited vulnerabilities listed in the advisory and to conduct forensic triage to determine whether systems have been compromised.
Our analysis: for CFOs, the practical question is whether to pull forward spend on remote-access hardening, backup isolation and compromise assessment, or to accept the current exposure. That trade-off is easier to defend when it is framed as a CFO funding decision with an estimate of loss exposure. Related resources: loss exposure calculator, cyber risk quantification and methodology.
SafePay decision and evidence table
Our analysis: the table below maps each attack behavior described in the announcement, plus CISA's forensic triage recommendation, to a decision, the evidence to request, an accountable owner and a verification action. Owners are suggested roles, not requirements from the advisory.
| Attack behavior | Decision it changes | Evidence to request | Accountable owner | Verification action |
|---|---|---|---|---|
| Compromised credentials, VPN access | Whether to fund full MFA coverage on remote access now | Inventory of remote-access paths with MFA status per path | CISO or IT lead | Sample accounts and confirm MFA is enforced at login |
| Known vulnerabilities in internet-facing devices | Whether to pull forward patching or replacement of edge devices | External asset list mapped to the vulnerabilities named in the full advisory, with patch dates | IT operations lead | Independent external scan compared against the stated patch status |
| Legitimate IT tools used to move laterally | Whether to fund segmentation or tighter admin-tool controls | Network segmentation diagram and list of approved remote admin tools | CISO | Review whether alerts fire on unapproved admin-tool use |
| Backups deleted or disabled | Whether backup isolation is adequate for recovery | Backup architecture showing offline or isolated copies and last restore test results | IT operations lead with CFO sign-off | Witness or review a recent restore test |
| Possible existing compromise (CISA forensic triage recommendation) | Whether to commission forensic triage | Results of checks against the indicators of compromise in the full advisory | CISO or incident response provider | Confirm the hunt scope covered internet-facing systems and backup servers |
| Data theft and extortion pressure | Whether response and communication plans cover direct victim contact | Incident response plan sections on extortion and executive contact | CFO and general counsel | Tabletop the scenario of a call from the attackers |
Our analysis: identity gaps link to identity and zero trust assurance, edge-device patching links to exposure management and patch prioritization, and the forensic triage and indicator checks link to detection and response. If a company's cyber insurance renewal is approaching, the same artifacts can strengthen insurance renewal evidence, though the press release itself says nothing about insurance.
How should SafePay exposure be reported to the board?
In our view, the board update should state which companies have exposed remote access, what share of that access has verified MFA and current patches, whether backups have passed a restore test, and whether any compromise checks are outstanding. Related resource for a consistent format: board cyber brief template. To see the format applied, inspect a sample decision memo.
Valty connects cyber-loss modeling, funding choices, governed actions, and evidence for supported workflows. Request a platform demo.
What remains unknown about SafePay?
- The press release does not list the specific vulnerabilities, device vendors or indicators of compromise; those are in the full advisory, which was not part of the supplied evidence.
- The announcement does not give dates for individual intrusions, and the publication date should not be read as an incident date.
- No loss values, ransom amounts or recovery outcomes are given in the supplied source.
- Whether any portfolio company has been targeted is unknown and can only be established through company evidence.
Sources
- CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors, Cybersecurity and Infrastructure Security Agency.
Limitations
This article relies only on the CISA press release announcing the advisory, not the full technical advisory. Public sources are not evidence about any specific company. Victim counts are as stated by the agencies and were not independently verified. Suggested owners, decisions and verification actions are analysis, not requirements from the advisory. Readers should consult the full advisory for vulnerability and indicator-of-compromise details.
