US agencies CISA and the FBI have warned that the SafePay ransomware group has breached more than 600 critical infrastructure organisations worldwide since 2024. While the advisory focuses on critical sectors, the wider message for European businesses is clear: ransomware groups continue to scale their operations, and attacks on essential providers can create knock-on risks for customers, suppliers and digital partners across multiple industries.

What happened

According to reporting on a joint warning cited by BleepingComputer, CISA said the SafePay ransomware gang has compromised over 600 critical infrastructure organisations globally since 2024. The involvement of CISA and the FBI indicates that the campaign is being treated as a significant cybersecurity threat.

Based on the source, the confirmed point is the scale described by the agencies. The article does not by itself establish that all affected organisations are in Europe, nor does it mean every business faces the same level of exposure. However, ransomware groups that successfully target critical infrastructure often rely on techniques that can also affect private companies outside those sectors.

Why it matters for European businesses

Even when incidents are reported by US authorities, the operational impact can extend well beyond the original victims. European companies may depend on cloud services, logistics providers, manufacturers, energy operators, telecoms, software suppliers or outsourced IT providers that form part of wider international infrastructure networks.

For SMEs, the main business risk is not limited to being directly encrypted by ransomware. Secondary effects can include service outages, delayed orders, interrupted payments, unavailable business systems, supplier downtime and increased phishing or extortion attempts following a major campaign.

The warning is also relevant in a European compliance context. Businesses covered by sector-specific security obligations, contractual security requirements, GDPR-related incident handling duties or NIS2-related expectations should treat major ransomware activity as a practical risk-management issue, not just a headline about large infrastructure operators.

Who may be affected

• Critical-sector suppliers and subcontractors that support energy, transport, healthcare, manufacturing, telecoms or public services.
• SMEs with managed IT environments that rely on remote access tools, shared credentials or third-party service providers.
• E-commerce and digital businesses that depend on uninterrupted hosting, payments, fulfilment and customer support systems.
• Marketing and web teams whose websites, CRMs, analytics platforms or campaign tools could be disrupted by an attack on an internal system or external vendor.
• Regulated organisations that need stronger documentation, incident response processes and supplier oversight.

What companies should consider

• Review ransomware resilience by checking backups, restoration times and whether critical data can be recovered without relying on the main network.
• Harden identity and access controls with multi-factor authentication, least-privilege access and tighter monitoring of administrator accounts.
• Audit third-party dependencies to identify which suppliers or platforms could create operational disruption if compromised.
• Update incident response plans so leadership, IT, legal and communications teams know how to respond to encryption, extortion or supplier-side outages.
• Improve endpoint and email security because phishing, credential theft and unpatched systems remain common entry points for ransomware actors.
• Check logging and detection coverage across servers, cloud services and remote access systems to improve the chances of early detection.
• Prepare business continuity alternatives for customer support, fulfilment, invoicing and internal collaboration if key systems become unavailable.

For European organisations, the key takeaway is not only the reported number of victims but the persistence and scale of ransomware operations targeting essential services. Companies should use warnings like this to reassess both direct cyber defences and the resilience of the vendors and digital infrastructure they depend on.