BridgePay ransomware attack takes payment gateways offline, disrupting merchants and council billing
Ransomware hit US payment processor BridgePay on 6 Feb 2026, knocking out card payments for merchants and some council portals. BridgePay says no card data was taken. Services were restored from 28 Feb and the incident closed 27 Apr. Nothing for families to do.
Nothing for you to do: BridgePay says no card data was compromised and the service is restored. If a council or shop billed you through BridgePay, check your statements as usual and ask them if you have a payment that failed or was doubled up during February.
What’s happening
On 6 February 2026, ransomware disabled the payment gateways, hosted payment pages and reporting systems of BridgePay, a US company that processes card payments for other businesses. Merchants that relied on it could not take card payments, and some accepted cash only. City utility payment portals, including those for Palm Bay in Florida and Frisco in Texas, were disrupted. BridgePay confirmed on 7 February that it was a ransomware attack and said it was working with the FBI, the US Secret Service and outside forensic teams. It said early findings showed no payment card data was compromised, that files which may have been accessed were encrypted, and that there was no evidence of usable data exposure. These are the company's own statements, and no forensic report has been published. The ransomware group has not been named in the sources read. Security validation was completed around 22 February, and gateways returned in phases from 28 February. BridgePay marked the incident resolved on 27 April 2026. The status page says nothing about non-card data such as merchant or personal information, and no breach notices were found.
- What
- Breach
- Affects
- BridgePay payment gateway (BridgeComm API, PayGuardian Cloud, MyBridgePay, PathwayLink)
- Fixed in
- Nothing to patch
- Since
- 6 Feb 2026
- Closed
- 27 Apr 2026
Timeline
- All clearNothing to patch
BridgePay marked the incident resolved. All TPI/TGateway instances and the BridgePay Gateway were restored, with approvals from some processors still being coordinated.
- All clearNothing to patch
After approvals from several payment processors, BridgePay began bringing its gateways back online in a phased, controlled way.
- Update
BridgePay said it had received a Letter of Compliance confirming its security validations were complete.
- Update
BleepingComputer reported the outage had hit downstream customers, including merchants able to take only cash and city utility payment portals in Palm Bay (Florida) and Frisco (Texas). The ransomware group was not named.
- Update
BridgePay confirmed the incident was a ransomware attack. It said early forensic findings showed no payment card data was compromised and that files which may have been accessed were encrypted.
- Made publicNo fix yet
BridgePay's status page reported an outage across its gateway systems, later tied to a cybersecurity incident. The FBI was involved and no restoration estimate was given.
Sources
- BridgePay Gateway outage incidentBridgePay · 27 Apr 2026
- Payments platform BridgePay confirms ransomware attack behind outageBleepingComputer · 8 Feb 2026