Payload
Data as of August 16, 2026.
Credential exposure before the attack
11% of Payload victims whose domain we can identify (9 of 82) had employee credentials leak in the 12 months before Payload named them as a victim.
We don't know whether any of these credentials were how Payload gained initial access.
What industries Payload targets
Sector identified for 70 of 82 victims.
| Manufacturing | 17 | |
| Financial Services | 9 | |
| Healthcare | 6 | |
| Construction | 5 | |
| Energy | 5 | |
| Government | 4 | |
| Legal | 4 | |
| Logistics | 4 |
Where the victims are located
Country identified for 71 of 82 victims.
| United States | 8 | |
| Malaysia | 7 | |
| Egypt | 6 | |
| Germany | 6 | |
| Austria | 5 | |
| Singapore | 4 | |
| India | 3 | |
| Italy | 3 |
Most recent Payload victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Zara Investment Holding zaraholding.com | Financial Services | Not identified | Aug 14, 2026 |
| Baya Technologies baya-tech.com | Manufacturing | Israel | Aug 12, 2026 |
| B&B Hydraulik-Technik bb-hydraulik.de | Manufacturing | Germany | Aug 12, 2026 |
| Stücheli Architekten stuecheli.ch | Construction | Switzerland | Aug 12, 2026 |
| Hans & Jos. Kronenberg kronenberg-gmbh.de | Manufacturing | Germany | Aug 4, 2026 |
| CKR Consulting Engineers ckr.co.za | Not identified | South Africa | Jul 20, 2026 |
| Roofinox roofinox.com | Manufacturing | Austria | Jul 13, 2026 |
| Commune of Castries castries.fr | Government | France | Jul 10, 2026 |
| Vela Film velafilmsrl.com | Not identified | Italy | Jul 6, 2026 |
| Tofutown tofutown.com | Manufacturing | Germany | Jul 3, 2026 |
| Clínica La Sabana clinicalasabana.com | Healthcare | Colombia | Jun 29, 2026 |
| Mosaic Partners mosaic-partners.com | Not identified | South Africa | Jun 29, 2026 |
| Software Arge softwarearge.com | Technology | Turkey | Jun 29, 2026 |
| Energie Netze Bern myenb.ch | Energy | Switzerland | Jun 22, 2026 |
| Preferred Properties preferred-properties.org | Real Estate | United States | Jun 22, 2026 |
| Qualiflex AG qualiflex.ch | Manufacturing | Switzerland | Jun 22, 2026 |
| Editora Irmãos Vitale vitale.com.br | Education | Brazil | Jun 22, 2026 |
| Sporton International sporton.com.tw | Telecommunications | Taiwan | Jun 17, 2026 |
| MACOFIN HELLAS maco-fin.com | Financial Services | Greece | Jun 15, 2026 |
| Marino Food Products marino.com.in | Not identified | India | Jun 15, 2026 |
Showing the 20 most recent of 82. Browse recent data breaches for more.
Payload leak sites
Addresses we've seen Payload publish victims from. Any .onion address needs the Tor Browser.
payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onionpayload6eualw6kni6v2lqn7ovjcl76ojx25z5unsyvqo3lbqy3bo5qd.onionmfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion
Payload questions
Is Payload still active?
Yes. Payload posted its most recent victim on August 14, 2026. That's 6 victims in the last 30 days.
How many victims has Payload claimed?
Payload has named 82 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Payload first appear?
The first victim we recorded for Payload was posted on February 18, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Payload target?
Manufacturing accounts for the most victims we can classify, with 17. Financial Services follows at 9. We could identify a sector for 70 of 82 victims, so treat this as the shape of the targeting rather than a full census.
Has Payload already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.