Yes, it can, and a recent federal warning explains how.
On October 20, CISA, the FBI, and partner agencies issued a joint advisory on SafePay, a ransomware gang that has hit at least 600 organizations since August 2024. SafePay targets businesses and critical infrastructure, and I believe that matters even if your office is small and local. Many of the tools these attackers use are automated, so a small company can get caught up in an attack without ever being picked as a target. And a local business that serves critical infrastructure could be targeted directly.
How they get in
According to CISA’s summary, SafePay’s ways in include exposed or weak credentials, brute-force password attacks, VPN access, phished accounts, and unpatched edge devices like firewalls and VPNs. Once inside, it goes after recovery: the advisory says it deletes shadow copies and resets network-attached storage (NAS) that holds backups. Then it steals data, encrypts systems, and in some cases calls the victim directly.
That is why we push so hard on multi-layered protection paired with good backups. No single layer holds up against all of that.
What I saw as internal IT
When I became IT Manager, boosting password security in Active Directory and setting proper file and folder permissions was one of our biggest initiatives. The main change was everyone getting used to not having access to everything on the network drive. Workflows shifted a little, but everyone knew the change was coming (communication and leadership buy-in are key), and people adapted quickly. The lesson stuck with me: much of the damage an attacker can do depends on what a single stolen password is allowed to reach.
But wouldn’t a backup on the same network go down too?
It can. That is the reason for the 3-2-1 rule: three copies of your data, on two kinds of storage, with one offsite. We reduce the risk to a NAS by giving the backups their own dedicated service account (with a unique and secure password), so a stolen everyday login can’t touch them. And if ransomware does take the NAS down, we restore from immutable cloud backups, copies that can’t be changed or deleted once they’re written.
What I would do in the morning
- Tighten how people sign in. Start with single sign-on through Microsoft Entra ID, especially for VPN access. If your VPN or application doesn’t support Entra, use a password manager plus passkeys or multi-factor authentication.
- Patch the front door.CISA puts firewalls, VPNs, and other internet-facing devices first on its patching list.
- Check your backups. Ask whether a copy sits somewhere your everyday logins can’t reach, and whether anyone has restored from it recently.
If you aren’t sure how those answers look for your office, that is a normal place to start. Our Free Cybersecurity Assessment is a no-pressure way to find out.
