SafePay advisory counts at least 600 victims; stolen logins and old flaws remain the entry routes

A minimum of 600, with an important missing denominator

At least 600 separate victims from multiple critical-infrastructure sectors have been affected by SafePay since August 2024, according to a joint CISA, FBI and partner announcement on 20 October 2026. The agencies also describe wider SafePay activity against businesses and critical infrastructure across North America, South America, Europe and Australia. They do not break the 600 down by sector or country, disclose a UK count, or measure how many people had data stolen. It calls SafePay one of the most active ransomware groups of 2026.

The agencies name two broad ways into a network: an identity route involving exposed, stolen or guessed credentials and VPN access, and an unpatched-system route involving known vulnerabilities in internet-exposed products. Once inside, the activity described in the announcement includes data theft, encryption and interference with recovery, including deleted shadow copies and resets of network-attached backup storage. That sequence is a campaign-level description, not proof that every step happened at every victim.

What the count and the independent record actually measure

Source and denominator distinctions, read 21 October 2026. The official minimum and leak-site claims are not additive or interchangeable.

Measure	What it establishes	What it does not establish
At least 600 victims	The agencies' minimum of separate SafePay victims from multiple critical-infrastructure sectors since August 2024.	A full global total, a UK total, a number of individuals, or a sector-by-sector breakdown.
Four named regions	The official bulletin names North America, South America, Europe and Australia.	How many victims were in each region or in any named country.
76 German leak-site claims in 2025	Google Threat Intelligence Group counted SafePay claims against German companies in its own 2025 leak-site study.	76 independently verified incidents, or a subset that can be added to the agencies' 600.
Five CVEs	The mirrored advisory names five distinct flaws associated with observed access methods.	That every victim was exposed to all five, or that any named product is vulnerable when fully patched and correctly configured.

Google Threat Intelligence Group's separate study counted 76 SafePay claims against German companies in 2025, which it says were 25% of German victim posts in its dataset that year. That is a leak-site observation with a different geography, period and method. A criminal group's post is a claim, not a forensic finding about data theft or encryption. The two figures cannot be used to calculate SafePay's German or UK share of the official 600.

Two entry routes, and five specific flaws to inventory

The official bulletin identifies credential exposure, brute-force password attempts and VPN access. It notes the actors have used Mullvad VPN addresses; this is context for an investigation, not a reason to block every customer using that provider. The mirrored technical advisory says phished account profiles and two Cisco flaws appeared in investigations, while automated exploitation of three other CVEs was observed against internet-exposed systems. The distinction matters: changing a password without patching an exposed service leaves one door open, while patching alone does not invalidate a stolen login.

CVEs named in the reproduced joint advisory, with affected product families verified against Cisco, Veeam and SonicWall advisories. Consult each vendor's current affected-release matrix before deciding whether a specific deployment is exposed.

Product family and CVE	Vendor-described weakness	Check first
Cisco ASA or FTD, CVE-2020-3259	Web-services information disclosure under specific AnyConnect or WebVPN configurations.	Is the affected service enabled, and is the appliance on a fixed supported release?
Cisco ASA or FTD, CVE-2023-20269	Remote-access VPN weakness that can enable credential guessing or an unauthorised clientless SSL VPN session under stated conditions.	Review the VPN configuration, authentication logs and Cisco's fixed-release matrix.
Veeam Backup & Replication, CVE-2023-27532	An unauthenticated user inside the backup-infrastructure network perimeter may obtain encrypted credentials from the configuration database.	Is the backup service reachable from more networks than intended, and has the fix been applied?
Veeam Backup & Replication, CVE-2024-40711	Unauthenticated remote code execution in affected Veeam releases.	Confirm the build against the current Veeam security bulletin and restrict reachability.
SonicWall SonicOS, CVE-2024-40766	Improper access control in affected firewall software.	Check firmware and SonicWall's exposure conditions.

The product descriptions come from Cisco's 2020 notice and 2023 notice, Veeam's first and second bulletins, and SonicWall's advisory. An advisory naming a CVE does not establish that it was exploited in every SafePay intrusion, or that an organisation running the product is compromised. It gives defenders a precise inventory and exposure check.

Why legitimate administration can mask the middle of an intrusion

According to the reproduced technical advisory, operators have raised privileges on existing accounts or created new ones, then used ordinary remote-management channels such as PsExec, Windows Remote Management and RDP. They have enumerated network shares, staged files with archive tools, and used file-transfer or cloud tools including RClone, WinSCP and, in some cases, OneDrive. This is a defender-level pattern, not a single mandatory attack script. Each listed utility also has legitimate uses. The useful signal is an unusual account, host, time, destination and follow-on action, especially when those events form a sequence.

The same reproduction describes actors stopping Volume Shadow Copy and resetting backup network-attached storage to factory settings before or during the final impact phase. That makes recovery a separate security boundary: a backup stored on a reachable device under the same administrative control can be destroyed even if the data was copied successfully earlier. The official bulletin independently confirms both deleted shadow copies and NAS resets. Operators also threaten publication of stolen data, so restoring an encrypted server does not, by itself, resolve the confidentiality incident.

A campaign-level defensive sequence from CISA's bulletin and the reproduced technical advisory. Rows are investigative pivots, not a claim that this order occurred at every victim.

Stage	Evidence to review	What a hit alone does not prove
Entry	VPN failures followed by success; unfamiliar remote access; vulnerable edge or backup systems.	A Mullvad address or failed login alone does not identify SafePay.
Control and movement	New privileged accounts and remote-management activity outside an approved change window.	PsExec, WinRM or RDP is not malicious by name alone.
Collection and transfer	Large archives, unusual RClone or WinSCP activity, and unexpected cloud-upload destinations.	An archive or transfer utility alone does not prove exfiltration.
Recovery interference	Shadow-copy service changes, NAS resets and failed restore tests.	A missing backup alone does not attribute the cause.
Extortion	Encrypted data, ransom communications and any evidence of data transfer.	Encryption does not show which records were copied or who later saw them.

What a security team should do first

For UK operators, the National Crime Agency and North West Regional Organised Crime Unit are co-authors of the joint advisory. That participation makes the warning relevant to UK defenders; it does not establish a UK incident count. The official bulletin's most immediate controls are patching exposed systems, strengthening identity and MFA, and restricting administrative tools and privileges. An organisation should test whether each control actually blocks the corresponding step in its own environment, not merely record that a product or policy exists.

The questions the advisory leaves open

The public material reviewed here does not break down the 600 by country, sector or access method; give a per-victim timeline; state how many victims had data exfiltrated; or show how many backups were reset. It also does not establish that SafePay used all five CVEs in the same case. The detailed indicator tables describe observations from November 2024 to August 2026, according to the reproduced advisory. Historical IP addresses can later host benign traffic, so a match requires context and current corroboration.

A decisive follow-up would be a country and sector breakdown with the agencies' counting method, alongside case-level evidence for which access routes and recovery attacks were observed. Until then, the defensible conclusion is narrower but actionable: at least 600 victims from multiple critical-infrastructure sectors are in the agencies' SafePay count, and the routes worth testing now are privileged identities, exposed older vulnerabilities and backups that an intruder could administer.