THREAT ACTOR
PAYOUTSKING_
DormantPAYOUTSKING is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of PAYOUTSKING, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 81
- 2025 39
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onionPayoutsKing snapshot · 2026-09-23 02:18 -
v2mw3spxqhggig5zjd6tjnfamwntrprreij3dq77jlq74dduyjafeead.onionsnapshot · 2026-05-20 11:12 -
c6nrwsloenpiat7zilh243nvhe7a3edsfm3ct3kpxhu2fv7z36ksjcad.onionsnapshot · 2025-07-07 15:32
Recent victims
The 50 most recent victims claimed by PAYOUTSKING. Total in the index: 120.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-02 | Proliance Surgeons | |
| 2026-08-28 | H.W. Lochner | |
| 2026-08-24 | W****s | |
| 2026-08-11 | Turner | |
| 2026-08-05 | H****r | |
| 2026-07-24 | T****r | |
| 2026-07-13 | Casta Diva Group | |
| 2026-07-06 | C****p | |
| 2026-06-30 | Welldyne | |
| 2026-06-29 | C****h | |
| 2026-06-22 | ****** | |
| 2026-06-15 | W****e | |
| 2026-05-28 | T****C | |
| 2026-05-13 | NTN Bearing Corporation of America | |
| 2026-04-30 | SCS Engineers | |
| 2026-04-30 | Epcon Communities | |
| 2026-04-30 | Data Exchange Corporation | |
| 2026-04-30 | SunSource | |
| 2026-04-27 | N****a | |
| 2026-04-24 | Flynn Group | |
| 2026-04-21 | H****l | |
| 2026-04-20 | S****e | |
| 2026-04-17 | D****n | |
| 2026-04-16 | S****p | |
| 2026-04-15 | Grace Design Studios | |
| 2026-04-15 | Englewood Lab | |
| 2026-04-15 | F****p | |
| 2026-04-02 | Blanchard | |
| 2026-04-02 | Blanchard Training and Development Likely to Engage tag. | |
| 2026-04-01 | TESSCO | |
| 2026-04-01 | H****o | |
| 2026-04-01 | Del Monte Foods | |
| 2026-04-01 | UFP Technologies | |
| 2026-03-31 | A****y | |
| 2026-03-27 | E****b | |
| 2026-03-20 | Peachtree Group | |
| 2026-03-18 | J****g | |
| 2026-03-17 | S****s | |
| 2026-03-17 | Kichler Lighting | |
| 2026-03-17 | Florida East Coast Railway | |
| 2026-03-12 | Central National Gottesman | |
| 2026-03-11 | T****O | |
| 2026-03-11 | B****. | |
| 2026-03-10 | Eyemart Express | |
| 2026-03-10 | Lc Industries | |
| 2026-03-10 | Powell Electronics | |
| 2026-03-10 | G****s | |
| 2026-03-09 | O****C | |
| 2026-03-03 | C****n | |
| 2026-03-02 | F****y |
CONFIRMED ATTACKS
Payoutsking confirmed attacks: 20 verified incidents
Ransomnews has verified 20 Payoutsking incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2025 to July 2026. United States accounts for 14 of them (70%), with victims recorded in 4 countries in total. The most affected sector is manufacturing, at 4 confirmed victims. Where a figure was disclosed (12 cases), these incidents account for 148,633 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Payoutsking incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Turner Construction Company | Construction | New York, United States | 17,149 | Unknown | Source |
| March 2026 | SunSource Borrower LLC | Manufacturing | Illinois, United States | 2,366 | Unknown | Source |
| March 2026 | AEC Holdco, LLC d/b/a Grace Design Studios, LLC | Service | Louisiana, United States | 709 | Unknown | Source |
| March 2026 | Blanchard Training & Development, Inc. | Service | California, United States | 310 | Unknown | Source |
| February 2026 | Central National Gottesman Inc. | Retail | New York, United States | 1,433 | Unknown | Source |
| February 2026 | Eyemart Express | Retail | Texas, United States | 46,284 | Unknown | Source |
| February 2026 | UFP Technologies | Healthcare | Massachusetts, United States | — | Unknown | Source |
| January 2026 | Lehigh Valley Restaurant Brands (LVRB) | Food and Beverage | Pennsylvania, United States | — | Unknown | Source |
| January 2026 | V. FRAAS GmbH | Manufacturing | Helmbrechts, Germany | — | Unknown | Source |
| December 2025 | Rameder Anhängerkupplungen & Autoteile GmbH | Retail | Leutenberg, Germany | — | Unknown | Source |
| November 2025 | Telia Norge AS | Utilities | Oslo, Norway | 2,000 | Unknown | Source |
| November 2025 | Chemirol | Manufacturing | Mogilno, Poland | — | Unknown | Source |
| November 2025 | Vereinigte Stadtwerke GmbH | Utilities | Ratzeburg, Germany | — | Unknown | Source |
| November 2025 | Bär Cargolift (Gerd Bär GmbH) | Manufacturing | Heilbronn, Germany | — | Unknown | Source |
| October 2025 | Time Equities, Inc. | Finance | New York, United States | 72 | Unknown | Source |
| August 2025 | Monterey Mushrooms, LLC | Food and Beverage | California, United States | 2,324 | Unknown | Source |
| June 2025 | Crenshaw Community Hospital | Healthcare | Alabama, United States | — | Unknown | Source |
| June 2025 | Glenwood Management | Construction | New York, United States | 8,146 | Unknown | Source |
| May 2025 | Institute of Culinary Education | Education | New York, United States | 33,342 | Unknown | Source |
| April 2025 | Gateway Community Services, Inc. | Healthcare | Florida, United States | 34,498 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Payoutsking's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.