Cyber Threat Actor: Payouts King

Payouts King is an alias used by a ransomware group. The group claimed responsibility for a data breach at Turner Construction. The breach was disclosed on July 2, 2026. Turner Construction reported unauthorized access to its systems. No further details about the group's origins or structure are publicly available in the source.

The exposed personal data included Social Security numbers, salaries, dates of birth, bank account details, and possibly passport numbers. The group asserted that it had exfiltrated 27.2 terabytes of data. The stolen data comprised engineering documents, military project files, contracts, non-disclosure agreements, and materials covered by International Traffic in Arms Regulations. Turner Construction notified at least 6,098 affected individuals about the breach. The company offered multi-year identity protection services to those impacted. The breach also prompted internal reviews of data security practices at the firm.

Law firms have begun investigating the incident for possible class-action lawsuits on behalf of affected individuals. The ransomware claim identifies Payouts King as actors employing ransomware tactics. No public information links the group to a specific state sponsor, criminal consortium, or geographic region. Additional details about their typical targets, tools, or operational patterns are not present in the provided source. Further public reporting would be required to expand on these details.