ZeroHour

payoutsking

ransomware group · aka PayoutsKing · unknown · active since 2026-06-15 (earliest leak-site post tracked by this dashboard)

Victims · 7d
0flat
Victims · 30d
3active targets
Victims · 90d
11
All-time (tracked)
117since 2025-07-07
Last post
09-02 03:49UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

PayoutsKing is a data-extortion group tracked on this dashboard since its first leak-site post on 2026-06-15, with 12 victims listed in total and the most recent post on 2026-09-02. It operates a leak site where it threatens to publish stolen data from non-paying victims, consistent with a double-extortion model. Its listed victims are concentrated in U.S. healthcare, engineering, and construction, with at least one European hospitality-sector company also named. Public vendor reporting on the group is limited: its origins, operator affiliations, initial-access methods, and ransom earnings are not widely documented and remain unknown.

Tactics & tooling
  • Double extortion: steals data and threatens publication unless a ransom is paid
  • Operates a dedicated leak site naming victims, sometimes with partially masked names
  • Low-volume, selective victim list (12 named victims in tracked activity)
  • Multi-sector targeting, including healthcare, engineering, construction, and hospitality
  • Initial access and attack tooling: not publicly documented (unknown)
  • Whether the group deploys its own encryptor or operates extortion-only: unknown
Targeted sectors
HealthcareEngineering & professional servicesConstructionHospitality & events
Notable public victims

Proliance Surgeons, H.W. Lochner, Turner, Casta Diva Group, Welldyne

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
Proliance Surgeons · 14d ago
H.W. Lochner · 18d ago
W****s · 22d ago
Turner · Aug 11, 2026
H****r · Aug 5, 2026
T****r · Jul 24, 2026
Casta Diva Group · Jul 13, 2026
C****p · Jul 6, 2026
Welldyne · Jun 30, 2026
C****h · Jun 29, 2026
****** · Jun 22, 2026
W****e · Jun 15, 2026
T****C · May 28, 2026
NTN Bearing Corporation of America · May 13, 2026
SCS Engineers · Apr 30, 2026
Epcon Communities · Apr 30, 2026
Data Exchange Corporation · Apr 30, 2026
SunSource · Apr 30, 2026
N****a · Apr 27, 2026
Flynn Group · Apr 24, 2026
H****l · Apr 21, 2026
S****e · Apr 20, 2026
D****n · Apr 17, 2026
S****p · Apr 16, 2026
Grace Design Studios · Apr 15, 2026
Englewood Lab · Apr 15, 2026
F****p · Apr 15, 2026
Blanchard · Apr 2, 2026
Blanchard Training and Development Likely to Engage tag. · Apr 2, 2026
TESSCO · Apr 1, 2026
H****o · Apr 1, 2026
Del Monte Foods · Apr 1, 2026
UFP Technologies · Apr 1, 2026
A****y · Mar 31, 2026
E****b · Mar 27, 2026
Peachtree Group · Mar 20, 2026
J****g · Mar 18, 2026
S****s · Mar 17, 2026
Kichler Lighting · Mar 17, 2026
Florida East Coast Railway · Mar 17, 2026
Central National Gottesman · Mar 12, 2026
T****O · Mar 11, 2026
B****. · Mar 11, 2026
Eyemart Express · Mar 10, 2026
Lc Industries · Mar 10, 2026
Powell Electronics · Mar 10, 2026
G****s · Mar 10, 2026
O****C · Mar 9, 2026
C****n · Mar 3, 2026
F****y · Mar 2, 2026

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .