INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Feds Issues Advisory About SafePay Ransomware Group

| 2026-10-21 14:02 CRITICAL HIGH RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
The SafePay ransomware group, identified since August 2024, has been targeting businesses and critical infrastructure entities in North and South America, Europe, and Australia. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint advisory about this group. SafePay's attacks affect approximately 62.2 million individuals, making it one of the largest U.S. healthcare data breaches of all time. The attackers use various techniques for initial access, including brute force password attacks, credential exposure, vulnerability exploitation, and phishing, before exfiltrating valuable files, encrypting them with ransomware, and issuing demands for payment to unlock the files and prevent stolen data from being leaked online.
Technical Mitigations AI-generated
• Patch Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259. • Regularly patch Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711. • Implement SonicWall SonicOS vulnerability CVE-2024-40766 patches.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2024-40711CVE-2024-40711 CVE-2023-20269CVE-2023-20269 CVE-2023-27532CVE-2023-27532 CVE-2024-40766CVE-2024-40766 CVE-2020-3259CVE-2020-3259
Target & Sectors
LATAM LATAM DACH DACH FIVE_EYES FIVE_EYES governmentgovernment
Incident Timeline
‎August 2024
Threat actors using the SafePay ransomware group exfiltrated and encrypted data from Conduent Business Services, affecting approximately 62.2 million individuals.
target_region Australia
SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia.
target_region EUROPE
SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia.
target_region LATAM
SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia.
organisation Conduent Business Services
Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data.
data_breach 8.5 terabytes
Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data.
organisation the Zero Trust Principle
Administrative tools and privileges should be restricted, and the Zero Trust Principle should be implemented.
organisation ICAM
Account security should be strengthened by implementing identity, credential, and access management (ICAM) policies and multifactor authentication.
‎Oct 21, 2026
The U.S. Cybersecurity and Infrastructure Security Agency, FBI, Secret Service, German, and UK cybersecurity agencies jointly issued a advisory about the SafePay ransomware group on October 21, 2026.
industry Government
General Document Context
tactic Ransomware
Feds Issues Advisory About SafePay Ransomware Group Posted By Steve Alder on Oct 21, 2026
organisation Secret Service
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.
organisation USSS
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.
organisation SafePay
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.
‎2026/10/21
Threat actors from the SafePay Ransomware Group used various techniques, including brute force attacks and vulnerability exploitation of devices like Cisco Adaptive Security Appliances and Veeam Backup & Replication systems.
organisation SafePay Ransomware Group
Feds Issues Advisory About SafePay Ransomware Group.
organisation HIPAA Journal
…EE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Once networks are compromised, SafePay actors take over existing accounts or create new ones and use legitimate system tools for credential theft, network scanning, lateral movement, and data exfiltration.
organisation CVE-2023-20269
…actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766.
organisation the Cisco Adaptive Security Appliance
…actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766.
organisation CVE-2020
…actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766.
organisation the Veeam Backup & Replication
…actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766.
organisation CVE-2023-27532 & CVE-2024-40711
…actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766.
organisation SonicWall
…actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766.
Tactical Metrics
Metrics
data_breach
8
Terabytes
Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data.
Intelligence Sources
HIPAA Journal 2026-10-21