SafePay Has Hit 600 Organizations: Why Deleting Your Backups Is Step One of the Attack, Not an Afterthought

Ransomware resilience is not measured by whether backups exist. It is measured by whether attackers can reach them, whether those copies survive an attack, and whether your team can restore operations under pressure.

A joint advisory from the CISA, FBI, and international partners warns that SafePay ransomware has affected approximately 600 organizations worldwide, including organizations in multiple critical infrastructure sectors. The advisory, released October 20, 2026, describes activity observed through August 2026.

SafePay’s reported pattern is a serious reminder: attackers may work to undermine recovery before they encrypt files. That makes backup deletion part of the attack, not a last-minute detail.

THE SAFEPAY ATTACK PATTERN: ACCESS, STEAL, DESTROY, ENCRYPT

SafePay’s reported methods are not limited to one route into a network. The advisory describes initial access through exposed or vulnerable internet-facing systems, including VPN and other edge devices, as well as stolen credentials, password guessing, and phishing.

Once inside, attackers may use compromised or newly created accounts and legitimate remote-management tools to move through an organization. The sequence can include:

1. Gain access through a vulnerable edge device or compromised account.
2. Expand access by using credentials and legitimate administrative tools.
3. Reach backup infrastructure and interfere with recovery capabilities.
4. Steal data, creating additional pressure through extortion threats.
5. Encrypt files and demand payment.

The advisory specifically reports backup-destruction behavior, including stopping the Volume Shadow Copy Service and resetting network-attached storage containing backups to factory settings. In other words, attackers may try to remove recovery options before or during encryption.

This does not mean every SafePay incident follows an identical, step-by-step script. But it does show why defenders should treat suspicious access to backup systems as a potential incident, not routine administration.

BACKUPS ARE AN IDENTITY AND ACCESS PROBLEM, TOO

Organizations often think of backup protection as a storage question: Are files being copied? How long are they retained? Is there enough capacity?

Those questions matter. But they are incomplete if an attacker who compromises an ordinary account can also access, alter, or delete the backups.

Backup resilience depends on who can access backup systems, how that access is authenticated, and whether production systems can change protected copies. If the same credentials or network paths connect production and backup environments, a compromise in one area can put the other at risk.

Review whether:

• Backup administration uses separate, tightly controlled accounts.
• Privileged access requires MFA, especially for VPNs and critical systems.
• Backup systems are segmented from ordinary production networks.
• Users and service accounts have only the access they need.
• Changes to backup configurations and retention are logged and reviewed.
• Immutable or offline copies are protected from routine administrator access.

The CISA advisory recommends a layered approach: patch known-exploited vulnerabilities promptly, implement strong identity and access controls, use MFA wherever possible, segment networks, and maintain secure backups that are regularly tested. Consult the full advisory for its complete recommendations and indicators of compromise.

WHAT TO MONITOR BEFORE FILES ARE ENCRYPTED

Encryption is a visible and disruptive stage of an attack. But earlier activity may create warning signs: an unusual login to a VPN, unexpected use of a privileged account, access to a backup console from an unfamiliar device, or a sudden change to network-attached storage.

A security team can look for correlated activity across identity systems, endpoints, network devices, and backup infrastructure. For example, an anomalous login followed by new administrative activity and backup configuration changes may deserve urgent investigation, even if no files are encrypted yet.

That is not a promise that every attack will be detected days in advance. Attackers may move quickly, and no single alert guarantees detection. The practical lesson is that monitoring and investigation create opportunities to recognize suspicious activity earlier than waiting for an encryption event or a failed restore.

Cenova Cyber’s 24/7 security monitoring brings together SIEM, MDR, automated analysis, and analyst investigation to help organizations prioritize and respond to security events. Our SOC collects telemetry across endpoints, cloud platforms, identity systems, and network devices, then investigates and escalates activity that warrants attention.

Monitoring is most useful when the right signals are available and there is a clear response process. Confirm that your team knows who reviews critical alerts, who can isolate affected systems, and how you will preserve evidence while containing an incident.

MAKE RECOVERY A CAPABILITY, NOT AN ASSUMPTION

A backup job that reports “successful” does not prove your business can recover. A file may be incomplete, a restore may take too long, or the backup itself may be reachable by the same compromised credentials as production.

Build confidence by testing recovery before an incident. Include the systems and data your organization needs to resume essential operations, and document who makes decisions during a recovery. Test more than whether a file can be retrieved: validate that systems, applications, and dependencies can be restored in a usable order.

CISA and the FBI recommend maintaining backups that are offline, encrypted, immutable, and regularly tested, with copies held in separate, secure locations. A strong recovery plan also assigns owners, defines priorities, and sets expectations for restoring essential services.

Use these questions to assess your current readiness:

• Can a compromised production account delete or modify your backups?
• Are backup administration and production access separated?
• Do you have offline or immutable copies, and have you tested restoring from them?
• Would your monitoring alert you to unusual access or changes to backup infrastructure?
• Does your response plan specify who investigates, contains, and authorizes recovery?

If any answer is unclear, treat that as a task to resolve, not a reason to assume your backups are safe.

BUILD A RESPONSE PLAN BEFORE THE INCIDENT

SafePay’s reported tactics underline an uncomfortable truth: attackers can target the systems organizations depend on to recover. Closing that gap takes more than adding storage. It requires disciplined access controls, network separation, reliable monitoring, and tested recovery procedures.

Cenova Cyber provides managed cybersecurity services and 24/7 monitoring designed to help organizations manage risk, investigate suspicious activity, and strengthen operational resilience. We work with your team to identify practical priorities, not just produce another list of alerts.

Request a free security posture review to assess how well your access controls, monitoring, and backup protections hold up against a ransomware scenario. Contact Cenova Cyber to start the conversation.