// THREAT ACTOR

PAY2KEY_

Active

PAY2KEY is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of PAY2KEY — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

7 Victims tracked

1 / 2 Active mirrors

2021-09-09 First listing

2021-12-29 Most recent

Victims by year

2021 7

Leak site mirrors

2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion Pay2Key Leak Directory! snapshot · 2022-03-15 21:08
pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p. I2Pd HTTP proxy snapshot · 2026-08-19 22:02

Recent victims

The 50 most recent victims claimed by PAY2KEY. Total in the index: 7.

Date listed	Victim	Description
2021-12-29	MT-LAW [Markman&Tomashin Law Firm]
2021-09-09	MT-LAW [Markman&Tomashin Law Firm]
2021-09-09	INTER - InterElectric
2021-09-09	InfiApps - Joyvoo
2021-09-09	Intel - Habana Labs
2021-09-09	IAI - Israel Aerospace Industries
2021-09-09	Portnox - Network Security Solutions

// CONFIRMED ATTACKS

Pay2key confirmed attacks: 6 verified incidents

Ransomnews has verified 6 Pay2key incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from November 2020 to March 2026. Israel accounts for 5 of them (83%), with victims recorded in 2 countries in total. The most affected sector is technology, at 3 confirmed victims.

6Verified incidents

2Countries

2020–2026Active range

—Paid, where outcome known

Confirmed victims by year

20205
20261

Most affected sectors

Technology3
Service1
Legal1
Manufacturing1

Most affected countries

Israel5
Switzerland1

Verified Pay2key incidents

Date	Organisation	Sector	Location	Records	Ransom paid	Source
March 2026	Häpo Reifencenter AG	Service	Wimterthur, Switzerland	—	Unknown	Source
December 2020	Portnox	Technology	Ra'anana, Israel	—	Unknown	Source
December 2020	Israel Aerospace Industries	Manufacturing	Lod, Israel	—	Unknown	Source
December 2020	Habana Labs	Technology	Tel-Aviv, Israel	—	Unknown	Source
November 2020	Markman & Tomashin	Legal	Rehovot, Israel	—	Unknown	Source
November 2020	InfiApps	Technology	Netanya, Israel	—	Unknown	Source

Claimed vs confirmed. The figures above the fold on this page come from Pay2key's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.