Florida East Coast Railway targeted by Payoutsking ransomware group

• Ransomware group: Payoutsking
• Country: United States
• Sector: Transportation
• Announcement date: April 30, 2026

Payoutsking claims data breach at Florida East Coast Railway

The threat actor known as Payoutsking has listed the Florida East Coast Railway on its leak site, claiming to have successfully carried out a ransomware attack against the organization. According to the announcement made by the group, the organization's networks were breached, resulting in both the encryption of systems and the exfiltration of sensitive information.

This type of double extortion tactic is a common strategy used by modern ransomware groups. In such scenarios, attackers do not merely lock the victim's systems to demand a ransom for decryption; they also steal sensitive data to use as leverage. By threatening to release stolen information on public leak sites, attackers increase the pressure on the victim to comply with ransom demands, often targeting sensitive corporate or personal data to maximize their impact.

Details of the claimed attack

The claims made by the Payoutsking group suggest a significant breach of the organization's digital infrastructure. The group asserts that the attack occurred around March 2, 2026, and the announcement was subsequently made public on April 30, 2026. The threat actor claims that the breach involved a combination of data encryption and unauthorized data exfiltration, which is a hallmark of sophisticated ransomware campaigns designed to maximize operational disruption and reputational damage.

While the group has made these claims publicly, it is important to note that the specific details regarding the breach remain limited. The group has not provided specific details or sample files regarding the content of the leaked data. Furthermore, no specific information regarding the ransom demand has been disclosed in the announcement.

Data involved in the incident

The Payoutsking group has specified the volume of data they claim to have stolen during the incident. The listing identifies the following regarding the alleged exfiltration:

• A total data volume of 148 GB.

The listing names no specific data types or individual file categories that were allegedly compromised.

About Florida East Coast Railway

Florida East Coast Railway is a regional railroad company operating in the state of Florida, United States. The company provides freight transportation services and operates a strategic rail network along the east coast of Florida. Given its role in the transportation sector, the company serves as a vital component of the regional logistics and supply chain infrastructure.

Potential impact and industry implications

This incident may lead to significant disruptions in the organization's operational processes and the exposure of critical logistics data. Because the organization provides critical infrastructure services, the severity of the breach could be heightened by the essential nature of its operations. Such disruptions can have ripple effects throughout the supply chain and regional transportation networks.

As the organization is based in the United States, potential data breaches may result in legal consequences under state-level privacy laws and federal regulations. If employee or customer data has been compromised, secondary risks such as identity theft and targeted phishing attacks may be observed. These secondary attacks often follow a primary breach, as stolen credentials or personal information are sold on illicit forums or used to gain further access to other systems.

Public information regarding the Payoutsking group is currently limited; therefore, the group's specific methods and motivations remain uncertain. For organizations operating in critical infrastructure sectors like transportation, maintaining robust defensive measures is essential. Common defensive steps typically include implementing multi-factor authentication, maintaining offline backups, conducting regular network segmentation, and ensuring continuous monitoring of network traffic to detect unauthorized exfiltration attempts early in the attack lifecycle.