payload
First seen February 17, 2026Active78 claimed victims
The claims below are reproduced as posted by payload on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Brüninghoff Group | October 20, 2026 | ransomlook | — |
| BW Office World | October 20, 2026 | ransomlook | — |
| Boullard Musique | October 8, 2026 | ransomlook | — |
| Netech (Neeser Technik AG) | September 28, 2026 | ransomware_live | — |
| Qualiflex Datacenter | HWZ-Studiengnge (fh-hwz.ch), myenb.ch, etc | August 20, 2026 | ransomware_live | — |
| Zara Investment Holding | August 13, 2026 | ransomware_live | — |
| Baya Technologies | August 11, 2026 | ransomware_live | — |
| Stücheli Architekten | August 11, 2026 | ransomware_live | — |
| B&B Hydraulik | August 11, 2026 | ransomware_live | — |
| Hans & Jos. Kronenberg GmbH | August 3, 2026 | ransomware_live | — |
| CKR Consulting Engineers | July 19, 2026 | ransomware_live | — |
| Roofinox | July 10, 2026 | ransomware_live | — |
| The commune of Castries | July 9, 2026 | ransomware_live | — |
| Vela Film S.r.l. | July 5, 2026 | ransomware_live | — |
| ENB Versich | July 5, 2026 | ransomware_live | — |
| Tofutown | July 2, 2026 | ransomware_live | — |
| Villea Hotels in AttanaHo | June 29, 2026 | ransomware_live | — |
| Mosaic Partners | June 26, 2026 | ransomware_live | — |
| Software Arge | June 26, 2026 | ransomware_live | — |
| Clínica La Sabana | June 26, 2026 | ransomware_live | — |
| Preferred Properties | June 20, 2026 | ransomware_live | — |
| Editora Irmãos Vitale | June 20, 2026 | ransomware_live | — |
| ENB Versicherungen | myenb.ch | June 20, 2026 | ransomware_live | — |
| SPORTON International Inc. | June 16, 2026 | ransomware_live | — |
| myipo.gov.my | June 13, 2026 | ransomware_live | — |
| Villea Hotels in AttanaHotels | June 8, 2026 | ransomware_live | — |
| Hansoll Textile in Vietnam | June 8, 2026 | ransomware_live | — |
| Plaza Lama | June 8, 2026 | ransomware_live | — |
| Robinsons | May 21, 2026 | ransomware_live | — |
| Internal Medicine and Pediatrics of Cullman | May 21, 2026 | ransomware_live | — |
| A-Sonic Logistic Solutions | May 21, 2026 | ransomware_live | — |
| G Theodor Freese | May 21, 2026 | ransomware_live | — |
| Kabushiki Gaisha Hodozuka Setsubi | May 19, 2026 | ransomware_live | — |
| Elohim Law Corporation | May 19, 2026 | ransomware_live | — |
| Tang Seng Nitrogen & Pump Systems Pte. Ltd. | May 19, 2026 | ransomware_live | — |
| Inteceng.com.my (+ Tsksynergy.com.my + Amemanufacturing.com.my + Woodnova.com.my) | May 13, 2026 | ransomware_live | — |
| Gorey Community School | May 13, 2026 | ransomware_live | — |
| PROM (Peakside Ros Outlet Management) | April 29, 2026 | ransomware_live | — |
| Rural Municipality of Gimli | April 27, 2026 | ransomware_live | — |
| caravaningcity.com | April 23, 2026 | ransomware_live | — |
| b3-bruck.at | April 23, 2026 | ransomware_live | — |
| meditron.com.ve | April 23, 2026 | ransomware_live | — |
| Peroni Sosa Tellechea Burt & Narvaja | April 23, 2026 | ransomware_live | — |
| Al Sulaiti Law Firm | April 20, 2026 | ransomware_live | — |
| Better House | April 20, 2026 | ransomware_live | — |
| JOH Investments Limited | April 20, 2026 | ransomware_live | — |
| TFE Group | April 16, 2026 | ransomware_live | — |
| orientalweavers.com | April 16, 2026 | ransomware_live | — |
| Sunlight Express Airways | April 16, 2026 | ransomware_live | — |
| Marino Food Products Pvt | April 16, 2026 | ransomware_live | — |
| Franziskusschule Wilhelmshaven | April 16, 2026 | ransomware_live | — |
| El Wastani Petroleum Company (WASCO) | April 8, 2026 | ransomware_live | — |
| Tscherne Consulting Steuerberatung GmbH | April 3, 2026 | ransomware_live | — |
| United Finance Egypt | April 3, 2026 | ransomware_live | — |
| SAYEGH | April 1, 2026 | ransomware_live | — |
| NKAR Travels & Tours | March 30, 2026 | ransomware_live | — |
| A A Al Moosa Enterprises (ARENCO Group) | March 28, 2026 | ransomware_live | — |
| Don-Nan | March 28, 2026 | ransomware_live | — |
| Q2 Artificial Lift Services | March 28, 2026 | ransomware_live | — |
| carlysle.net | March 26, 2026 | ransomware_live | — |
| Vancompare Insurance | March 25, 2026 | ransomware_live | — |
| iGLS | March 23, 2026 | ransomware_live | — |
| HOPPECKE Singapore | March 22, 2026 | ransomware_live | — |
| TS Lines Philippines | March 20, 2026 | ransomware_live | — |
| Notaría 89 | March 19, 2026 | ransomware_live | — |
| Lucky Innovative Manufacturing Corporation | March 19, 2026 | ransomware_live | — |
| Royal Bahrain Hospital | March 15, 2026 | ransomware_live | — |
| Río Grande (Puerto Rico) | March 14, 2026 | ransomware_live | — |
| Tyler Media | March 14, 2026 | ransomware_live | — |
| United Limsun International Trading | March 14, 2026 | ransomware_live | — |
| Thai Solar Energy Public | March 14, 2026 | ransomware_live | — |
| Easy Servizi | March 14, 2026 | ransomware_live | — |
| In.Sa.Cor | March 14, 2026 | ransomware_live | — |
| Alcoholes Finos Dominicanos | March 14, 2026 | ransomware_live | — |
| Grid Fine Finishes | March 14, 2026 | ransomware_live | — |
| J.T. Pack of Foods | March 14, 2026 | ransomware_live | — |
| Almacenes Distribuidores de la Frontera | February 17, 2026 | ransomware_live | — |
| sodic.com | February 17, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).