THREAT ACTOR
PAYOUTSKING_
ActivePAYOUTSKING is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of PAYOUTSKING, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 94
- 2025 39
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onionCaptcha snapshot · 2026-11-11 07:01 -
v2mw3spxqhggig5zjd6tjnfamwntrprreij3dq77jlq74dduyjafeead.onionsnapshot · 2026-05-20 11:12 -
c6nrwsloenpiat7zilh243nvhe7a3edsfm3ct3kpxhu2fv7z36ksjcad.onionsnapshot · 2025-07-07 15:32
Recent victims
The 50 most recent victims claimed by PAYOUTSKING. Total in the index: 133.
| Date listed | Victim | Description |
|---|---|---|
| 2026-11-04 | Autoscribe Corporation | |
| 2026-11-03 | iLending & J.C. Flowers & Co. | |
| 2026-10-29 | Y****s | |
| 2026-10-26 | i****. | |
| 2026-10-22 | Merical LLC | |
| 2026-10-21 | i****g | |
| 2026-10-14 | P****y | |
| 2026-10-13 | Morrow Meadows Corporation | |
| 2026-10-07 | Merrill Iron & Steel | |
| 2026-10-06 | Watermark Retirement Communities | |
| 2026-10-03 | A****n | |
| 2026-10-02 | M****C | |
| 2026-09-23 | M****n | |
| 2026-09-02 | Proliance Surgeons | |
| 2026-08-28 | H.W. Lochner | |
| 2026-08-24 | W****s | |
| 2026-08-11 | Turner | |
| 2026-08-05 | H****r | |
| 2026-07-24 | T****r | |
| 2026-07-13 | Casta Diva Group | |
| 2026-07-06 | C****p | |
| 2026-06-30 | Welldyne | |
| 2026-06-29 | C****h | |
| 2026-06-22 | ****** | |
| 2026-06-15 | W****e | |
| 2026-05-28 | T****C | |
| 2026-05-13 | NTN Bearing Corporation of America | |
| 2026-04-30 | SCS Engineers | |
| 2026-04-30 | Epcon Communities | |
| 2026-04-30 | Data Exchange Corporation | |
| 2026-04-30 | SunSource | |
| 2026-04-27 | N****a | |
| 2026-04-24 | Flynn Group | |
| 2026-04-21 | H****l | |
| 2026-04-20 | S****e | |
| 2026-04-17 | D****n | |
| 2026-04-16 | S****p | |
| 2026-04-15 | Grace Design Studios | |
| 2026-04-15 | Englewood Lab | |
| 2026-04-15 | F****p | |
| 2026-04-02 | Blanchard | |
| 2026-04-02 | Blanchard Training and Development Likely to Engage tag. | |
| 2026-04-01 | TESSCO | |
| 2026-04-01 | H****o | |
| 2026-04-01 | Del Monte Foods | |
| 2026-04-01 | UFP Technologies | |
| 2026-03-31 | A****y | |
| 2026-03-27 | E****b | |
| 2026-03-20 | Peachtree Group | |
| 2026-03-18 | J****g |
CONFIRMED ATTACKS
Payoutsking confirmed attacks: 23 verified incidents
Ransomnews has verified 23 Payoutsking incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2025 to July 2026. United States accounts for 17 of them (74%), with victims recorded in 4 countries in total. The most affected sector is manufacturing, at 5 confirmed victims. Where a figure was disclosed (15 cases), these incidents account for 377,287 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Payoutsking incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Turner Construction Company | Construction | New York, United States | 70,256 | Unknown | Source |
| March 2026 | Tessco LLC | Retail | Maryland, United States | 4,567 | Unknown | Source |
| March 2026 | LC Industries Inc. (LCI) | Manufacturing | North Carolina, United States | 2,247 | Unknown | Source |
| March 2026 | SunSource Borrower LLC | Manufacturing | Illinois, United States | 2,366 | Unknown | Source |
| March 2026 | AEC Holdco, LLC d/b/a Grace Design Studios, LLC | Service | Louisiana, United States | 709 | Unknown | Source |
| March 2026 | Blanchard Training & Development, Inc. | Service | California, United States | 310 | Unknown | Source |
| February 2026 | Del Monte Foods Corporation II Inc. | Food and Beverage | United States | — | Unknown | Source |
| February 2026 | Central National Gottesman Inc. | Retail | New York, United States | 9,126 | Unknown | Source |
| February 2026 | Eyemart Express | Retail | Texas, United States | 189,432 | Unknown | Source |
| February 2026 | UFP Technologies | Healthcare | Massachusetts, United States | — | Unknown | Source |
| January 2026 | Lehigh Valley Restaurant Brands (LVRB) | Food and Beverage | Pennsylvania, United States | 17,892 | Unknown | Source |
| January 2026 | V. FRAAS GmbH | Manufacturing | Helmbrechts, Germany | — | Unknown | Source |
| December 2025 | Rameder Anhängerkupplungen & Autoteile GmbH | Retail | Leutenberg, Germany | — | Unknown | Source |
| November 2025 | Telia Norge AS | Utilities | Oslo, Norway | 2,000 | Unknown | Source |
| November 2025 | Chemirol | Manufacturing | Mogilno, Poland | — | Unknown | Source |
| November 2025 | Vereinigte Stadtwerke GmbH | Utilities | Ratzeburg, Germany | — | Unknown | Source |
| November 2025 | Bär Cargolift (Gerd Bär GmbH) | Manufacturing | Heilbronn, Germany | — | Unknown | Source |
| October 2025 | Time Equities, Inc. | Finance | New York, United States | 72 | Unknown | Source |
| August 2025 | Monterey Mushrooms, LLC | Food and Beverage | California, United States | 2,324 | Unknown | Source |
| June 2025 | Crenshaw Community Hospital | Healthcare | Alabama, United States | — | Unknown | Source |
| June 2025 | Glenwood Management | Construction | New York, United States | 8,146 | Unknown | Source |
| May 2025 | Institute of Culinary Education | Education | New York, United States | 33,342 | Unknown | Source |
| April 2025 | Gateway Community Services, Inc. | Healthcare | Florida, United States | 34,498 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Payoutsking's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.