payoutsking
Also known as: Payouts KingFirst seen July 7, 2025Active112 claimed victims
The claims below are reproduced as posted by payoutsking on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
PayoutsKing is an active ransomware group observed through at least 2026 that has claimed attacks against a wide range of industries internationally — including Del Monte Foods and V. FRAAS — across the US, UK, Germany, and Ireland using standard double-extortion tactics.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Proliance Surgeons | September 2, 2026 | ransomlook | — |
| H.W. Lochner | August 28, 2026 | ransomlook | — |
| W****s | August 24, 2026 | ransomware_live | — |
| Proliance Surgeons | August 18, 2026 | ransomware_live | — |
| H.W. Lochner | August 3, 2026 | ransomware_live | — |
| H****r | August 3, 2026 | ransomware_live | — |
| T****r | July 23, 2026 | ransomware_live | — |
| C****p | July 6, 2026 | ransomware_live | — |
| Casta Diva Group | July 6, 2026 | ransomware_live | — |
| C****h | June 29, 2026 | ransomware_live | — |
| W****e | June 15, 2026 | ransomware_live | — |
| Welldyne | June 15, 2026 | ransomware_live | — |
| N****a | April 24, 2026 | ransomware_live | — |
| NTN Bearing Corporation of America | April 24, 2026 | ransomware_live | — |
| H****l | April 21, 2026 | ransomware_live | — |
| SunSource | April 20, 2026 | ransomware_live | — |
| Data Exchange Corporation | April 17, 2026 | ransomware_live | — |
| S****p | April 16, 2026 | ransomware_live | — |
| Epcon Communities | April 15, 2026 | ransomware_live | — |
| F****p | April 14, 2026 | ransomware_live | — |
| H****o | April 1, 2026 | ransomware_live | — |
| A****y | March 31, 2026 | ransomware_live | — |
| Englewood Lab | March 27, 2026 | ransomware_live | — |
| E****b | March 27, 2026 | ransomware_live | — |
| SCS Engineers | March 17, 2026 | ransomware_live | — |
| TESSCO | March 9, 2026 | ransomware_live | — |
| Grace Design Studios | March 9, 2026 | ransomware_live | — |
| Blanchard | March 9, 2026 | ransomware_live | — |
| G****s | March 9, 2026 | ransomware_live | — |
| O****C | March 9, 2026 | ransomware_live | — |
| Florida East Coast Railway | March 2, 2026 | ransomware_live | — |
| Central National Gottesman | March 2, 2026 | ransomware_live | — |
| Powell Electronics | February 26, 2026 | ransomware_live | — |
| I****G | February 26, 2026 | ransomware_live | — |
| Kichler Lighting | February 24, 2026 | ransomware_live | — |
| Grant Production Testing Services | February 24, 2026 | ransomware_live | — |
| Sofinter S.p.a | February 24, 2026 | ransomware_live | — |
| Lc Industries | February 19, 2026 | ransomware_live | — |
| Eyemart Express | February 19, 2026 | ransomware_live | — |
| Peachtree Group | February 19, 2026 | ransomware_live | — |
| UFP Technologies | February 19, 2026 | ransomware_live | — |
| Del Monte Foods | February 19, 2026 | ransomware_live | — |
| ESENTIA Energy Systems | February 6, 2026 | ransomware_live | — |
| Prater Engineering Associates | February 6, 2026 | ransomware_live | — |
| Telia Norge AS | January 21, 2026 | ransomware_live | — |
| Vortex Companies | January 19, 2026 | ransomware_live | — |
| M****l | January 14, 2026 | ransomware_live | — |
| C****g | January 14, 2026 | ransomware_live | — |
| B****p | January 14, 2026 | ransomware_live | — |
| V****S | January 14, 2026 | ransomware_live | — |
| L****p | January 14, 2026 | ransomware_live | — |
| A****g | January 14, 2026 | ransomware_live | — |
| A****s | January 14, 2026 | ransomware_live | — |
| Maderas del Alto Urgel | January 14, 2026 | ransomware_live | — |
| Ash & Lacy Holdings | January 14, 2026 | ransomware_live | — |
| Aero-Coating | January 14, 2026 | ransomware_live | — |
| Bespoke Home Interior Design Group | January 14, 2026 | ransomware_live | — |
| V. FRAAS | January 14, 2026 | ransomware_live | — |
| Caunton Engineering | January 14, 2026 | ransomware_live | — |
| Bär Cargolift | November 28, 2025 | ransomware_live | — |
| Rameder | November 28, 2025 | ransomware_live | — |
| Chemirol | November 27, 2025 | ransomware_live | — |
| Sanko Gosei Technology | November 27, 2025 | ransomware_live | — |
| V****l | November 25, 2025 | ransomware_live | — |
| S****e | November 25, 2025 | ransomware_live | — |
| Visionwheel | November 25, 2025 | ransomware_live | — |
| Soapeople | November 25, 2025 | ransomware_live | — |
| J****e | November 20, 2025 | ransomware_live | — |
| P****s | November 20, 2025 | ransomware_live | — |
| V****e | November 20, 2025 | ransomware_live | — |
| JJ White | November 20, 2025 | ransomware_live | — |
| Peugeot Motocycles | November 20, 2025 | ransomware_live | — |
| Vereinigte-stadtwerke | November 20, 2025 | ransomware_live | — |
| L****x | November 17, 2025 | ransomware_live | — |
| K****n | November 17, 2025 | ransomware_live | — |
| Lithographix | November 17, 2025 | ransomware_live | — |
| Klüber Lubrication | November 17, 2025 | ransomware_live | — |
| Klüber Elektroanlagenbau GmbH | November 17, 2025 | ransomware_live | — |
| Klüber Elektroanlagenbau | November 17, 2025 | ransomware_live | — |
| A****n | November 14, 2025 | ransomware_live | — |
| I****r | November 4, 2025 | ransomware_live | — |
| Irwin Car | November 3, 2025 | ransomware_live | — |
| T****s | October 22, 2025 | ransomware_live | — |
| Time Equities | October 22, 2025 | ransomware_live | — |
| Accord Carton | October 19, 2025 | ransomware_live | — |
| L****s | September 30, 2025 | ransomware_live | — |
| Linxx Global Solutions | September 30, 2025 | ransomware_live | — |
| M****s | August 8, 2025 | ransomware_live | — |
| Monterey Mushrooms | August 8, 2025 | ransomware_live | — |
| S****s | August 5, 2025 | ransomware_live | — |
| Sofo Foods | August 5, 2025 | ransomware_live | — |
| C****o | July 15, 2025 | ransomware_live | — |
| Creditinfo | July 15, 2025 | ransomware_live | — |
| T****n | July 14, 2025 | ransomware_live | — |
| Thompson+Hanson | July 14, 2025 | ransomware_live | — |
| G****d | July 9, 2025 | ransomware_live | — |
| G***** | July 9, 2025 | ransomware_live | — |
| S****H | July 7, 2025 | ransomware_live | — |
| Schlemmer Holding GmbH | July 7, 2025 | ransomware_live | — |
| KOLBUS | June 16, 2025 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).