Your Backup Was The Target

A joint advisory from federal and international agencies counts at least 600 organizations hit by one ransomware group since 2024. Once inside, the attackers reset the storage holding the victim's backups to factory settings — and in some cases deleted every network backup the company had. The backups were a target, not collateral.

On October 20 the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and the United States Secret Service, together with police forces in Germany and the United Kingdom, published a joint advisory about a ransomware group called SafePay. At least 600 organizations have been hit since 2024, across four continents. The detail worth your morning is not how they got in. It is what they did once inside: they reset the storage holding the victim's backups to factory settings, and in some cases deleted every network backup the company had. Our interest, and it is the uncomfortable one: we sell backup and monitoring. If you pay us for backup and every copy of it sits on your network, answering to accounts on your network, then what you have bought is a second copy rather than a recovery. That is a fair thing to hold us to. The technical part — you can skip this box Joint Cybersecurity Advisory AA26-293A, "#StopRansomware: SafePay Ransomware," released October 20, 2026 by the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and the United States Secret Service, with Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and its North West Regional Organised Crime Unit. The advisory states that the group has been active since August 2024, that its findings come from investigations "as recently as August 2026," that SafePay "was among the most active ransomware groups in 2026," and that it has "impacted at least 600 separate victims from multiple critical infrastructure sectors" across North America, South America, Europe and Australia. On initial access it names credential exposure, brute-force password attacks, phished account profiles and virtual private network access, the actors using the network addresses of one named commercial virtual private network service. It lists five catalog numbers for exploited software flaws — CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. A catalog number is a case number for one specific software flaw. The first two are described as affecting "edge device products," the other three as exploited "across internet-exposed systems … through automated scripts." The advisory names no vendor and no product for any of the five. On backups it is explicit, and says it twice: the actors "halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts," and "In some cases, SafePay threat actors deleted all network-attached backups of company data." Data is taken out before encryption, and "If the victim does not pay, SafePay posts the exfiltrated data to their SafePay leak website"; a representative also telephones the victim to apply pressure. The actors install ordinary commercial remote-control software on victim machines to move their own tools in — the advisory names those products and adds that such tools "should not be attributed as malicious without analytical evidence." Mitigations, in the advisory's own order: prioritise remediating known exploited vulnerabilities, meaning flaws criminals are already using, which the agency keeps a separate list of, and "specifically, prioritize patching KEVs in internet-facing systems"; require MFA "for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems"; use passwords of at least 15 characters and stop forcing frequent changes; "Maintain offline backups of data and regularly test and maintain backup and restoration processes"; ensure backups are "encrypted, immutable (i.e., cannot be altered or deleted)"; keep multiple copies "in a physically separate, segmented, and secure location"; segment networks; audit administrative accounts to least privilege; and the agencies "do not encourage paying ransom as payment does not guarantee victim files will be recovered." What that actually means Ransomware is software that locks up your files and demands payment to unlock them. This group also takes a copy of the files first and publishes them if you do not pay. Two separate problems out of one break-in. Getting in took nothing new. Passwords guessed, phished or already exposed, plus five known software flaws — the oldest catalogued in 2020 — in equipment at the edge of the network, like the firewall. The part that is different is what came next: the backups were a target rather than collateral. Not encrypted along with everything else. Destroyed on purpose, using the storage device's own factory-reset function, specifically to stop recovery. They also installed ordinary remote-control software — the legitimate kind, which is why the advisory warns that finding it is not proof of anything by itself. Why that order matters Most firms think of a backup as the thing that saves them after an attack. This group treated it as the thing to remove first. If your backup is a box on the same network answering to the same administrator accounts, whoever gets those accounts gets your backup too — and takes it first, because it is what makes a company pay. What to do, and all of it is in the advisory Keep one copy where the network cannot reach it. The advisory asks for offline backups, and for backups that cannot be altered or deleted. A factory reset cannot reach a copy nothing on your network can address. Restore something. The advisory asks you to test restoration regularly. A backup nobody has restored from is a belief rather than a backup. Patch what faces the internet first. The advisory is explicit about the order: flaws criminals are already exploiting, on internet-facing systems, ahead of everything else. Turn on MFA for webmail, remote access and any account reaching critical systems — the advisory's own three examples. If we run your backups, call and ask which copy is offline and when it was last tested. If that answer takes more than a minute to find, the answer is the finding.