↓Skip to main content
  1. News/

SafePay Ransomware: What to Ask Your IT Person About Backups and Remote Access

·6 mins
SafePay Ransomware Backups Remote Access Small Business
Table of Contents
On October 20, 2026, the FBI, CISA, the U.S. Secret Service and police agencies from Germany and the United Kingdom published a joint advisory about SafePay, a ransomware group. The advisory is written for government and critical-infrastructure defenders, not for business owners. We read it and turned the parts that matter to a 10 to 200 person business into four questions you can ask your IT person or managed service provider (MSP) this week.

What the advisory says, in plain terms #

The advisory says SafePay has been highly active since August 2024 and was among the most active ransomware groups in 2026. It says the group has affected “at least 600 separate victims from multiple critical infrastructure sectors” in North America, South America, Europe and Australia. That is the advisory’s wording. It is not a complete count, and the advisory does not say those victims were small businesses.

Here is how the advisory describes the group’s methods, in a few lines:

  • Getting in. Exposed or stolen passwords, repeated password guessing, phishing, VPN access, and known flaws in internet-facing systems, found with automated scripts.
  • Stealing first. Data is copied out before files are locked.
  • Pressure. A ransom note points to a chat portal, a representative phones the victim, and stolen data is posted on a leak site if the victim does not pay. Demands are typically a share of company revenue, in cryptocurrency.
  • Going after recovery. The group halts the Windows Volume Shadow Copy Service (a built-in feature that keeps restore points) and resets network storage holding backups to factory settings. In some cases it deleted all network-attached backups.
  • Using ordinary tools. It installs remote-support software on victim machines.

The Record independently reports the 600 figure and the remote-tool detail. Neither the advisory nor the coverage we read says anything about a Central Florida business, and we name no victim.

Question 1: Is at least one backup copy out of reach, and have we tested a restore? #

Ask: “Is at least one copy of our backups offline or unchangeable, so that someone who steals an administrator login cannot erase it? When did we last test a restore?”

The reason is the advisory’s account of backup targeting. Backups held on network storage are the kind the advisory says were reset or deleted. The advisory’s mitigations are to keep offline backups and regularly test the restore process, to make sure backup data is encrypted and immutable (it “cannot be altered or deleted”), and to keep copies in a physically separate, segmented, secure location. It lists hard drives, storage devices or the cloud as examples.

A good answer names where the copy lives, who can change it, and the date of the last restore test. “We have backups” is not yet an answer.

Question 2: Which remote-access tools are approved, and would anyone be told about a new one? #

Ask: “Which remote-access and remote-support tools are approved on our computers? If a new one appeared, would anyone be told?”

The advisory says the group installed legitimate remote desktop tools such as AnyDesk and TeamViewer on victims’ systems, and its tools table also lists ScreenConnect. The same table carries a caution: these tools “should not be attributed as malicious without analytical evidence” of the group’s use. These are ordinary products, and many offices use them for good reasons. We are not suggesting you remove anything.

The question is narrower. Did your IT person install each one, and would they know if someone else did? The advisory also recommends reviewing servers, workstations and Active Directory for new or unrecognized accounts, and blocking unknown or untrusted sources from reaching remote services on internal systems.

Question 3: Is multi-factor authentication required for email, VPN and every administrator account? #

Multi-factor authentication (MFA) means a second proof of identity, such as a code on a phone, in addition to the password. The advisory asks organizations to require it for all services to the greatest extent possible, “particularly for webmail, VPNs, and accounts that access critical systems.”

Since stolen and guessed passwords come first on the advisory’s list of entry routes, this is the question to push on. Ask which accounts do not have MFA yet, and why. Ask also when administrator accounts were last audited. The advisory recommends auditing administrator accounts and asks for passwords of at least 15 characters. It also advises against forcing password changes more often than once a year.

Question 4: Which internet-facing systems have updates waiting? #

Ask: “Which of our internet-facing systems, such as the firewall, VPN and remote-access gateways, have updates waiting? Is anything on CISA’s Known Exploited Vulnerabilities catalog?”

The catalog is CISA’s list of flaws that attackers are known to be using. The advisory asks organizations to fix those first, and to put internet-facing systems at the front of the line. You do not need to read the list yourself. You need your IT person to say which items are waiting, and by when.

None of these four questions is a promise. The advisory says its mitigations “reduce the likelihood and impact” of SafePay incidents. It does not say they stop an attack.

If files are encrypted or data may have been stolen #

The advisory’s early-stage advice is to find the affected computers and isolate them, by quarantining them or taking them offline. If files are already encrypted, it points to the Ransomware and Data Extortion Response Checklist in CISA’s #StopRansomware Guide. Then report.

The agencies urge prompt reports to the FBI’s Internet Crime Complaint Center (IC3), a local FBI or Secret Service field office, or CISA through its Incident Reporting System. They do not encourage paying a ransom, because payment does not ensure files come back and may embolden attackers. The advisory says organizations have “no obligation to respond” to the agencies about it, and that any reporting must be consistent with state and federal law. Ask your IT person or your insurance contact what other reporting duties apply to you.

What to do next #

Send the four questions to your IT person or MSP and ask for answers in writing. Treat a vague answer as “not yet confirmed.”

For another recent warning about stolen passwords and internet-facing remote access, see our FortiBleed post. We have no source connecting it to SafePay.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-20: First published, based on the sources below as of this date.

Sources #