Computer Repair · October 26, 2026 · ComputerKing Team
SafePay Ransomware Hits 600+ Organisations: CISA's Joint Advisory Warns Attackers Deliberately Delete Your Backups — A 6-Step SME Defence Guide
On October 20, 2026, CISA, the FBI and four other law-enforcement partners issued a joint SafePay ransomware advisory (AA26-293A): since August 2024, SafePay has affected at least 600 organisations. Entry routes include stolen credentials, brute-force attacks and known flaws in internet-facing systems; once inside, attackers steal data, encrypt systems, and deliberately target backups so recovery fails too.
Key Summary: On October 20, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA), together with the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit, issued a joint advisory on SafePay ransomware, catalogued as AA26-293A. It states that SafePay has affected at least 600 organisations since August 2024, across multiple critical infrastructure sectors in North America, South America, Europe and Australia, and ranks among the most active ransomware operations of 2026.
For Hong Kong SMEs, the number is not the most useful part of the advisory — the method is. SafePay does not merely encrypt files: it steals data first (double extortion) and deliberately damages backups — disabling backup services, factory-resetting NAS devices that hold backups, and deleting network backups. In other words, it attacks the very lifeline you expect to save you. This article turns the advisory's entry routes and mitigations into a checklist an SME can work through today.
1. Reading the advisory correctly: what the numbers do and do not mean
Three points of scope matter before anything else:
- At least 600 is a floor, not a total. The advisory presents it as a minimum count of confirmed victims; the real figure may be higher.
- No breakdown by country or sector is published. Do not read 600 as a Hong Kong figure, and do not read the absence of a Hong Kong breakdown as proof Hong Kong is unaffected — the advisory's value is in its methods and defences, not a regional ranking.
- Investigation findings run to August 2026. The advisory describes patterns observed over two years, not a single incident report.
Also note: SafePay is the name of a ransomware operation (a brand in the ransomware-as-a-service model), not a single virus strain. Taking down one brand does not end the business — affiliates move to another brand. So the point is not to memorise the name SafePay, but to remember the playbook: the entry routes and the backup-targeting, because the next advisory will likely describe the same playbook under a different name.
2. How SafePay gets in: three common routes
According to the advisory and related reporting, the main entry routes are:
| Entry route | What it means in practice | The opening SMEs commonly leave |
|---|---|---|
| Stolen credentials and brute force | Logging in with a stolen or guessed username and password | One password reused across systems, ex-employee accounts never disabled, no multi-factor authentication |
| Known flaws in internet-facing systems | Unpatched devices and services exposed to the internet | VPNs, remote desktop, NAS management interfaces and old router firmware left directly reachable |
| Edge devices and VPN routes | Entering the internal network through a VPN service or edge device | VPN protected by password alone, VPN appliances not updated for a long time |
Once inside, attackers use legitimate IT tools to move laterally across the network — which means antivirus may not raise an alarm, because the tools themselves are normal tools — then steal data, encrypt systems, and threaten to publish the stolen data. Some cases also involve direct phone calls pressuring victims. This steal-first, encrypt-second pattern is why having a backup is only half an answer: a backup fixes encryption, but it does not undo a data theft that has already happened.
3. Why backups are attacked first
Many SMEs treat backups as the last line of defence, and attackers think the same way — so they attack backups first. According to reporting on the advisory, SafePay's backup-targeting includes:
- Disabling backup-related services such as Volume Shadow Copy, so built-in restore points fail;
- Factory-resetting NAS devices that store backup data;
- Deleting network backups, so the assumption that another copy sits elsewhere on the network fails.
Add the most common structural weakness in SMEs: backups sharing the same network, the same domain and the same administrator account as production systems. Once an attacker holds administrator rights, they can control the backup console too. A USB drive left permanently plugged in, a NAS permanently online, and a backup account that is also a daily email account all open the same door.
The test for a backup is therefore not whether the backup job finished, but whether the backup still exists and still restores after an attacker has held administrator rights. For restore-testing practice, see our backup restore verification guide and Hong Kong backup strategy guide.
4. A 6-step SME defence checklist, from the advisory's mitigations
Every step below comes from the advisory's mitigations, rewritten as checks an SME can execute:
| Step | Action | What counts as done |
|---|---|---|
| 1. Patch internet-facing systems first | Apply the latest security updates to all internet-facing systems, VPN appliances and edge devices, especially known exploited vulnerabilities | A list of every internet-facing service, each confirmed updated — not a vague assumption |
| 2. Multi-factor authentication on all remote access | Enable MFA on every service that supports it, especially VPN, privileged accounts and email | Login is impossible without MFA — a requirement, not a recommendation |
| 3. Shrink the exposed surface | Disable unused remote tools and services; never expose remote desktop directly to the internet — use VPN plus MFA plus access restrictions | An external scan of your own exposure, with anything that should not be open closed immediately |
| 4. Segment and apply least privilege | Separate file servers, accounting systems and backup systems from the general office network; do not do daily work with an administrator account | A dedicated backup-console account, different from any daily email account, and a minimum number of domain administrators |
| 5. Offline or immutable backups, plus real restore tests | Keep at least one backup offline or immutable (unchangeable and undeletable within its retention period) and test restores regularly | Restore tests with a record, a date and an owner; backup media disconnected after the job, not left plugged in |
| 6. Watch backup alerts | Backup failures, changed backup settings and offline backup devices must alert someone who actually reads them — not a departed employee's mailbox | Deliberately stop one backup job and check that someone receives the alert and follows up |
Completing these six steps does not mean never being attacked. It means the cheapest entry routes are closed, so attacking you costs more and succeeds less often. Security is not one product bought once; it is closing the cheapest routes one by one.
5. If you suspect an intrusion: the first hour
If file extensions suddenly change, a ransom note appears on the desktop, or backups stop or disappear for no reason, follow this order. For full post-incident steps, see our ransomware recovery roadmap:
1. Isolate, do not wipe. Disconnect Ethernet, turn off Wi-Fi, pause cloud synchronisation, and keep backups disconnected from the infected network. Wiping and reinstalling destroys evidence needed for investigation and insurance claims.
2. Preserve evidence. Photograph the ransom note, record the time of discovery and the steps already taken, and keep logs.
3. Use out-of-band channels. Contact IT support and law enforcement by phone, not through an email system that may itself be monitored.
4. Do not contact the attackers or promise payment on your own. The FBI and CISA strongly discourage paying ransoms: payment does not guarantee file recovery, does not guarantee stolen data will be deleted, and may encourage further attacks. Any payment decision needs legal advice and law-enforcement input first.
The advisory's value is not in frightening you, but in giving you a checklist backed by six law-enforcement agencies. Work through the six steps above, tick them off, and whichever item is undone is the most worthwhile thing to do today. All service charges are by individual quotation; for help checking internet exposure, backup settings or restore testing, WhatsApp 2115 9219.
Frequently Asked Questions
Does the advisory's 600 organisations include Hong Kong companies?
No breakdown by country or sector is published — only that victims span multiple critical infrastructure sectors across North America, South America, Europe and Australia, and that 600 is a minimum confirmed count. Do not read it as a Hong Kong figure, and do not treat the absence of a breakdown as proof Hong Kong is unaffected — the point is the entry methods and defences.
We are a small company. Would SafePay bother with us?
Intrusion is often automated scanning for internet-facing flaws and weak passwords, not hand-picking targets. The difference for a small company is not whether it can be targeted, but that recovery resources are smaller — which makes patching internet-facing systems, enabling MFA and keeping offline backups more important, not less.
Does having backups mean we need not worry about SafePay?
No. SafePay deliberately targets backups, including disabling backup services, factory-resetting NAS devices and deleting network backups; and under double extortion, even a successful restore does not remove the threat of stolen data being published. Backups must be offline or immutable, and restore-tested regularly, to count as reliable.
Is paying the ransom the fastest fix after an attack?
The FBI and CISA strongly discourage paying ransoms: payment does not guarantee file recovery, does not guarantee stolen data will be deleted, and may encourage attackers to target more organisations. The correct order is to isolate, preserve evidence and backups, and contact IT support and law enforcement through out-of-band channels, with legal advice before any payment decision.