Your Backup Plan Is Not a Backup Plan

On October 20, the FBI and CISA released a joint advisory with an uncomfortable number in the headline: more than 600 organizations across critical infrastructure sectors, hit by a single ransomware group called SafePay. The advisory, co-authored with the U.S. Secret Service and law enforcement agencies in Germany and the United Kingdom, describes a campaign that has been running since August 2024 across North America, South America, Europe, and Australia.

Six hundred is a big number. But the number that should keep executives up at night is two: that is how many years the vulnerabilities SafePay exploits have been sitting in public databases with patches available.

The Open Doors

SafePay does not rely on exotic zero-day exploits. According to the advisory (AA26-293A), the group gets in through stolen or guessed credentials, brute-force attacks against VPN portals, and two specific flaws that have been public knowledge since the summer of 2024.

The first is CVE-2024-40711, a critical deserialization flaw in Veeam Backup and Replication with a severity score of 9.8 out of 10. It allows an unauthenticated attacker to execute code remotely on the backup server itself. Veeam released a patch in August 2024. CISA added it to its Known Exploited Vulnerabilities catalog in October 2024.

The second is CVE-2024-40766, an improper access control flaw in SonicWall firewalls with a severity score of 9.3. It affects three generations of SonicWall devices and has been linked to ransomware campaigns since shortly after its disclosure in August 2024.

Both patches have been available for more than two years. Both flaws remain common entry points.

What Happens After They Get In

This is where SafePay's playbook gets personal for anyone who has ever told a board, "We have backups."

After gaining initial access, SafePay operators move laterally through the network using standard administrative tools. Then, before deploying their encryption payload, they systematically destroy the safety net. They delete Volume Shadow Copies, the built-in Windows mechanism that lets administrators roll back files. They reset network-attached storage (NAS) devices to factory defaults, wiping backup data stored on those appliances.

If your organization runs Veeam for backup and an attacker exploits that same Veeam server for entry, the tool you were counting on to recover from ransomware is the tool that let the attacker in.

This is the difference between having a backup plan and having a plan that survives contact with an attacker. Most executives assume that "we have backups" means "we can recover." SafePay is proof that attackers now treat backup destruction as a standard phase of the operation, not an afterthought.

The Three Questions Every Board Should Ask

In Cyber Risk Is Business Risk, I outline the Three Questions framework for evaluating any cyber risk:

What could happen? An attacker walks through an unpatched VPN or backup server, moves through the network undetected, destroys every backup copy, and then encrypts production systems. Recovery goes from days to weeks or months. Operations stop. Revenue stops.

How likely is it? SafePay alone has hit more than 600 organizations in roughly two years. Manufacturing, professional services, and retail are the most frequently targeted sectors. The group also targets managed service providers and IT distributors, where a single compromise can cascade to hundreds of downstream partners. According to the advisory, SafePay continues to hit between 15 and 30 organizations every month in 2026.

What would it cost? Without functional backups, organizations face a binary choice: pay the ransom (with no guarantee of recovery) or rebuild from scratch. Either path costs millions in downtime, incident response, legal exposure, and reputational damage. For companies in regulated industries, add the cost of breach notification for every affected individual.

What to Ask Your CISO This Week

If you sit on a board or lead an organization, the SafePay advisory gives you a concrete reason to ask five questions before your next meeting:

1. Are our backup systems tested against destruction, not just data loss? A backup that has never been tested against an adversary who is actively trying to delete it is an assumption, not a control.
2. How old are the unpatched vulnerabilities on our internet-facing systems? If the answer includes anything from 2024, you have a two-year-old open door.
3. Do our backups live on the same network as our production systems? If the answer is yes, an attacker who compromises one can reach the other. Air-gapped or immutable backups are the minimum standard in 2026.
4. Do we use multi-factor authentication on every remote access point? The advisory specifically calls out stolen credentials and VPN access as primary entry methods. MFA is the single most effective mitigation.
5. Have we reviewed our vendor's security posture for the tools that protect us? When the backup vendor's own product is the attack vector, the vendor relationship is a risk conversation, not just a procurement conversation.

The Compliance Trap

Here is the uncomfortable truth embedded in this advisory: many of the 600 organizations that SafePay breached were almost certainly "in compliance." They had backup policies. They had firewall rules. They may have passed their last audit.

Compliance asks, "Do you have a backup?" Security asks, "Will your backup survive an attacker who knows exactly how to destroy it?"

That gap between checking a box and testing an assumption is where SafePay lives. It is where most ransomware groups live. The joint advisory is a signal from the government that this specific gap has been exploited at scale, across sectors, for two years.

If your organization has not acted on two-year-old patches and has not tested whether its backups can survive a determined adversary, the warning could not be more direct. The FBI, CISA, and their international partners are telling you exactly what is happening and exactly how to stop it. The only question left is whether your organization will act before it becomes number 601.