An international cybersecurity advisory has identified SafePay as one of the most active ransomware groups operating in 2026, with at least 600 organizations affected since August 2024. The warning has been issued by law enforcement and cybersecurity agencies in the United States, Germany, and the United Kingdom, which have documented attacks against businesses and critical infrastructure across four continents.
Published on October 20, the joint advisory provides new details about the group’s methods and increasing international reach. Investigators have tracked SafePay activity in North America, South America, Europe, and Australia, with attacks targeting organizations that provide essential services alongside commercial businesses.
Unlike many ransomware operations that recruit outside criminals to conduct attacks, SafePay is believed to operate as a centralized group. Its members use several methods to enter corporate networks, including stolen passwords, phishing, password-guessing attacks, and exploitation of known security vulnerabilities in internet-facing systems.
Once they gain access, the attackers attempt to obtain administrative privileges and move between connected devices. They frequently use legitimate system management tools, allowing malicious activity to imitate routine IT operations. Investigators have also observed the group disabling security software and interfering with backup systems.
SafePay typically first steals sensitive information, and then encrypts files and demands payment. This double-extortion strategy presents victims with two problems: inaccessible systems and the possibility that confidential documents will be published online.
The criminals generally request cryptocurrency payments, sometimes calculated according to the victim organization’s revenue. In certain cases, SafePay representatives have also contacted victims by telephone to increase pressure during negotiations.
Several major incidents have been linked to the group, including the 2025 attack on technology distributor Ingram Micro, which disrupted order processing and exposed personal information. SafePay has also claimed responsibility for attacks involving business services provider Conduent and British technology company Microlise.
Security researchers have observed SafePay maintaining a steady pace of attacks throughout 2026. Although its activity appears to have peaked in late 2025, the group has continued targeting approximately 15 to 30 organizations per month, according to ransomware researchers cited in recent reporting.
The advisory recommends that organizations strengthen account security, require multifactor authentication, update vulnerable network devices, and maintain protected backups. Authorities also warn that paying a ransom does not guarantee the restoration of encrypted information.