CISA and FBI Warn of SafePay Ransomware, Citing at Least 600 Victims Since 2024

CISA, the FBI, the U.S. Secret Service and international partners issued a joint SafePay ransomware warning on October 20, 2026. CISA’s bulletin cites at least 600 affected organizations across multiple critical-infrastructure sectors since August 2024. Follow OrangeX.com Security.

Access controls and recovery are both targets

The bulletin describes access through exposed credentials, password attacks, phishing and vulnerabilities in internet-facing systems. SafePay combines data theft with encryption and threats to publish stolen information. The actors may also delete recovery copies or reset storage holding backups, disrupting restoration.

The agencies urge organizations to patch exposed systems, prioritize known exploited vulnerabilities, strengthen identity and access management with multifactor authentication, and limit administrative tools and privileges to necessary users. More reporting is available in OrangeX.com News.

OrangeX.com Analysis

For digital-asset operations, the warning is relevant to account access and service recovery as well as data protection. The cross-sector victim count does not identify 600 crypto companies or prove a breach at any particular exchange, wallet or blockchain. The recommendations reduce risk rather than guarantee immunity. Verification resources are available in the OrangeX.com Trust Center.