01How SafePay operates
According to the advisory, SafePay gains access through compromised credentials and known vulnerabilities in internet-facing VPN devices. Once inside, it deletes backups, steals data and then encrypts systems—so victims face both downtime and the threat of a leak.
Nothing in that chain is exotic. It succeeds because a password was reused or leaked, a VPN was not patched, or backups could be reached and deleted from the same network.
02Close the front door
Patch VPN and firewall appliances as soon as vulnerabilities are listed as actively exploited, and remove devices that are no longer supported. Require MFA on every remote access path, including accounts used by IT suppliers.
Review VPN accounts: disable former employees and unused service accounts, and alert on logins from unusual countries or at unusual hours.
03Protect the backups
Because SafePay deletes backups first, at least one copy must be offline or immutable and protected by separate credentials. A backup that the domain administrator can delete is not a safe backup.
Test restoration regularly. Knowing how long it takes to recover key systems is part of the business plan, not only an IT task.
04If you are hit
Isolate affected systems, preserve evidence, contact your incident response provider and report to the authorities. Consult the official advisory for indicators of compromise and recommended mitigations.
Sources & further reading
Daily CISO — Brief, October 24, 2026 (SafePay joint advisory)