Background and Timeline: On February 7, 2026, U.S. payment provider BridgePay confirmed a ransomware attack that crippled its core operations. The incident began on Friday and quickly escalated into a nationwide disruption that lasted through the weekend. This outage highlights the extreme systemic risk posed by ransomware to “non-bank” financial infrastructure, which serves as a critical link in the retail economy.

Modus Operandi: Attackers successfully infiltrated BridgePay’s network and deployed file-encrypting ransomware that knocked key systems offline. The ransomware prevented thousands of merchants from processing credit card payments and merchant authorizations. The attackers likely utilized double-leverage tactics, spending weeks mapping critical systems and identifying backups before launching the encryption phase.

Victims and Financial Impact: The nationwide outage affected multiple payment services for thousands of retailers and merchants across the United States. While initial forensic findings indicate that no payment card data (PCI) was compromised, the business interruption caused significant financial losses for merchants. Typical demands for infrastructure of this scale in 2026 now often exceed $5 million, reflecting high-impact lockout scenarios.

Investigation and Agencies Involved: BridgePay immediately engaged federal law enforcement agencies and external forensic teams to investigate the incident. Forensic experts are examining server logs to determine if the initial entry point was a phishing lure or a supply chain vulnerability. The investigation is focusing on whether the ransomware gang used specialized stealthy methods to deliver the payload and evade detection.

Arrests and Suspects: No arrests have been made yet, and no specific group has publicly claimed responsibility on their leak site. The technical signatures of the attack are being linked to a professional ransomware-as-a-service (RaaS) group that emerged in mid-2025. Forensic findings suggest a well-funded group that specializes in high-impact infrastructure lockouts for maximum leverage.

Broader Implications and Trends: The attack reinforces the need for organizations to replace discontinued or unsupported edge devices, which are becoming primary entry points for ransomware. This reflects a pivot where ransomware gangs return to data encryption levers as simple extortion tactics begin to deliver lower ROI. Availability has become as critical as confidentiality in the 2026 threat landscape.