SafePay ransomware: FBI warns of gang tied to Conduent breach

The advisory is a rare multinational effort. Alongside the FBI and CISA, it was written with the US Secret Service, Britain’s National Crime Agency, a regional crime unit covering North West England, and the state criminal police office of Rhineland-Palatinate in Germany. It draws on investigations into SafePay activity seen between November 2024 and August 2026.

The agencies describe SafePay as one of the most active ransomware operations of 2026, with victims across North America, South America, Europe and Australia. Unlike many gangs that rent their tools to outside hackers, SafePay is a closed, private crew that doesn’t use affiliates. Since early 2025 it has grown into the space left behind by two notorious groups, BlackCat (also called ALPHV) and LockBit, and researchers have said parts of its code look like LockBit’s.

The 600 figure is a floor, not a ceiling. SafePay’s dark web leak site only names organizations that refuse to pay, so the true number of companies it has hit and extorted is higher.

There’s nothing exotic about the front door. According to the advisory, SafePay gets in through:

• Leaked or guessed passwords, including brute-force attacks that try password after password.
• Phishing, using compromised accounts to slip inside.
• Unpatched edge devices such as VPNs and firewalls, found with automated scanning scripts. The advisory lists a string of known bugs by their tracking numbers, several of them years old and long since patched.

The agencies also noted the attackers often connect from IP addresses belonging to the VPN service Mullvad.

Once inside, the gang creates new accounts or hijacks existing ones, then moves around using ordinary admin tools so it blends in. It switches off security software, sometimes changes staff passwords to lock people out, bundles up valuable files and copies them out. Only then does it drop the ransomware, often using remote desktop programs like AnyDesk or TeamViewer to deliver it.

Restoring from backups is how most companies escape a ransom demand, and SafePay knows it. The agencies say the group deletes Windows shadow copies (automatic snapshots of files) and resets network storage boxes that hold backups. That leaves victims with encrypted systems and nothing clean to roll back to.

Then comes the squeeze. SafePay uses double extortion: pay to unlock your systems, or the stolen files get published. The ransom is pitched as a slice of the company’s revenue, payable in cryptocurrency, and a representative phones the victim to keep up the pressure. The agencies stress that paying doesn’t guarantee you’ll get your files back, and they urge victims to report attacks to law enforcement.

For everyday people, the biggest SafePay story is Conduent. The attack happened in October 2024 and went unnoticed for almost three months. SafePay claimed to have taken 8.5TB of data. Conduent later told affected people that the stolen files may have held medical information and health insurance details as well as Social Security numbers, birth dates, home addresses and names.

Conduent filed an $80 million class action settlement on October 16, 2026, without admitting fault. If you can document fraud or identity theft tied to the breach, you may be able to claim up to $3,500 in cash, and claimants are also covered for credit and medical data monitoring. The settlement still needs final court approval. SafePay has also claimed attacks on British tech firm Microlise and one of the largest US suppliers of IT products and services.

If you got a Conduent breach letter, or simply live in the US and use state benefits or toll roads, a few steps are worth the ten minutes:

1. Freeze your credit at Equifax, Experian and TransUnion. It’s free and stops new accounts being opened in your name.
2. Watch your health insurance statements for treatments you never had.
3. Keep any breach letter, since you’ll need it if you file a claim.
4. Ignore unexpected calls about your data or benefits and contact the agency through its official number.

If you run or work in IT for a small company, the advisory reads like a to-do list. Turn on multifactor authentication for every remote login and admin account. Patch VPNs, firewalls and other internet-facing devices first, prioritizing anything on CISA’s list of actively exploited bugs. Limit who has admin rights, and keep at least one backup offline, where an attacker inside your network can’t reach it. The full advisory includes technical indicators that IT teams can feed into their security tools today.