This week ·
Critical infrastructure organizations worldwide
How they got in, as reported. Stolen or reused passwords.
← All items this week- Date
- 21 Oct 2026
- Place
- United States
- Who
- Critical infrastructure organizations worldwide
- The way in
- Stolen or reused passwords
- Source
- BleepingComputer
01 · What was reported
What was reported.
The SafePay ransomware operation has breached over 600 critical infrastructure organizations globally since August 2024. Law enforcement and cybersecurity agencies issued a joint advisory warning that the group utilizes double-extortion...
The way in, as the source states it: stolen or reused passwords.
02 · What we check for it
What we check for it.
Addresses at your domain in monitored breach databases.
03 · If this happens at your firm
If this happens at your firm.
- Give every work account a second sign-in step, and never use a work password anywhere else.What changes: a code or a tap on the phone at each new sign-in. It stays on. A backup code or a second device covers a lost phone, and the method is changed in the account's security settings.
- Never approve a sign-in you did not start. A prompt you did not start means your password is known.
- Change the password of any account that gets prompts nobody started, the same day.
04 · Source
Source.
Source: BleepingComputer ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.