Aero-Coating listed on Payoutsking ransomware leak site

• Ransomware group: Payoutsking
• Country: Germany
• Sector: Manufacturing
• Announcement date: April 30, 2026

The manufacturing company Aero-Coating has been listed on the leak site of the ransomware group known as Payoutsking. According to the announcement made by the threat actors, the group claims to have exfiltrated 520 GB of data belonging to the organization.

The claimed attack and data exfiltration

The Payoutsking group has published data they claim belongs to Aero-Coating on their dedicated leak site. The threat actor alleges that they obtained the 520 GB of data following a security incident that they state occurred on January 14, 2026. While the announcement was made on the leak site on April 30, 2026, the group claims the initial breach happened months prior.

To demonstrate the validity of their claims, the group has shared sample files that reportedly contain the organization's confidential projects and sensitive employee information. This tactic is a common feature of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt systems but also threaten to release stolen data to pressure victims into paying a ransom.

Details of the claimed stolen data

The announcement states that the stolen data is extensive and covers various aspects of the organization's operations. According to the group, the information includes confidential project data involving major entities such as Zeiss and Airbus, as well as confidential correspondence. The leaked content reportedly encompasses a wide range of sensitive files, including:

• Personally identifiable information (PII)
• Employee and executive documents
• Engineering drawings
• Financial documents
• Payrolls

The inclusion of such diverse data types suggests a deep intrusion into the company's internal systems, touching upon administrative, financial, and technical departments.

About Aero-Coating

Aero-Coating is a manufacturing company based in Bielefeld, Germany. The firm specializes in industrial surface coating and painting services. It provides technical coating solutions primarily for the aerospace, automotive, and mechanical engineering sectors.

Potential impact and industry implications

This leak may result in the exposure of personal identification information belonging to Aero-Coating employees and executives. Furthermore, the disclosure of confidential data regarding the organization's commercial partnerships in the aerospace sector could create risks for supply chain security. Because the organization operates in Germany, this incident may lead to legal consequences under the General Data Protection Regulation (GDPR).

Additionally, the shared financial data could potentially facilitate targeted attacks against the organization's financial structure. In the manufacturing and aerospace sectors, such breaches are particularly sensitive due to the high value of engineering intellectual property and the interconnected nature of global supply chains. When a specialized provider like Aero-Coating is targeted, the ripple effects can impact multiple downstream partners.

While public information regarding the Payoutsking group is limited, the incident highlights the ongoing risks faced by industrial manufacturers. Organizations in this sector often employ various defensive steps to mitigate such risks, such as implementing robust access controls, maintaining offline backups, and conducting regular security audits to protect both proprietary engineering data and sensitive employee information.