CISA: SafePay ransomware hit more than 600 critical infrastructure organizations

· Cybersecurity · United States

The U.S. Cybersecurity and Infrastructure Security Agency says the SafePay ransomware gang has breached more than 600 critical infrastructure organizations worldwide since 2024. The figure makes SafePay one of the most prolific ransomware operations tracked by the agency, with victims spanning sectors that underpin essential services. The disclosure underscores how ransomware remains the dominant threat to critical infrastructure operators, and it gives defenders a concrete benchmark for prioritizing detection and recovery planning around a group known for high volumes of victims rather than one-off, high-profile attacks.

Why it matters：Critical infrastructure operators face ransomware as their dominant risk, and a gang with 600-plus victims signals that current defenses and disclosure practices are not keeping pace.

Key points

  • The tally covers breaches since 2024.
  • Victims are critical infrastructure organizations worldwide.

Sources (original reporting)

More stories from this day