PayoutsKING

Active
70 victims named on the leak site
1 in the last 30 days
53 in the last 12 months
Jul 2025 first victim we recorded
Aug 12, 2026 most recent victim posted
3 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

31.4% of PayoutsKING victims whose domain we can identify (22 of 70) had employee credentials leak in the 12 months before PayoutsKING named them as a victim.

We don't know whether any of these credentials were how PayoutsKING gained initial access.

What industries PayoutsKING targets

Sector identified for 51 of 70 victims.

Manufacturing21
Construction5
Financial Services4
Healthcare4
Energy3
Agriculture2
Telecommunications2
Education2

Where the victims are located

Country identified for 58 of 70 victims.

United States32
Germany7
United Kingdom5
Italy4
Spain3
France2
Poland1
Turkey1

Most recent PayoutsKING victims

VictimSectorCountryPosted
Turner Construction turnerconstruction.comConstructionUnited StatesAug 12, 2026
Casta Diva Group castadivagroup.comMediaItalyJul 14, 2026
WellDyne welldyne.comHealthcareUnited StatesJul 1, 2026
NTN Bearing Corporation of America ntnamericas.comManufacturingUnited StatesMay 13, 2026
Dexcom dex.comHealthcareUnited StatesApr 30, 2026
Epcon Communities epconcommunities.comReal EstateUnited StatesApr 30, 2026
SCS Engineers scsengineers.comNot identifiedUnited StatesApr 30, 2026
SunSource sun-source.comManufacturingUnited StatesApr 30, 2026
Flynn Group flynn.comConstructionCanadaApr 27, 2026
Englewood Lab englewoodlab.comManufacturingSouth KoreaApr 16, 2026
Grace Design Studios grace-design.comNot identifiedUnited StatesApr 10, 2026
Blanchard blanchard.comNot identifiedUnited StatesApr 6, 2026
Tessco Technologies tessco.comTelecommunicationsUnited StatesApr 6, 2026
Del Monte Foods delmontefoods.comNot identifiedUnited StatesApr 1, 2026
UFP Technologies ufpt.comManufacturingUnited StatesApr 1, 2026
Peachtree Group peachtreegroup.comFinancial ServicesUnited StatesMar 23, 2026
Florida East Coast Railway fecrwy.comLogisticsUnited StatesMar 17, 2026
Kichler Lighting kichler.comManufacturingUnited StatesMar 17, 2026
Central National Gottesman cng-inc.comFinancial ServicesUnited StatesMar 12, 2026
Eyemart Express eyemartexpress.comRetailUnited StatesMar 11, 2026

Showing the 20 most recent of 70. Browse recent data breaches for more.

PayoutsKING leak sites

Addresses we've seen PayoutsKING publish victims from. Any .onion address needs the Tor Browser.

  • payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion
  • v2mw3spxqhggig5zjd6tjnfamwntrprreij3dq77jlq74dduyjafeead.onion
  • c6nrwsloenpiat7zilh243nvhe7a3edsfm3ct3kpxhu2fv7z36ksjcad.onion

PayoutsKING questions

Is PayoutsKING still active?

Yes. PayoutsKING posted its most recent victim on August 12, 2026.

How many victims has PayoutsKING claimed?

PayoutsKING has named 70 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 53 of them were posted in the last 12 months.

When did PayoutsKING first appear?

The first victim we recorded for PayoutsKING was posted on July 8, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does PayoutsKING target?

Manufacturing accounts for the most victims we can classify, with 21. Construction follows at 5. We could identify a sector for 51 of 70 victims, so treat this as the shape of the targeting rather than a full census.

Has PayoutsKING already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.