KOLBUS listed on payoutsking leak site

• Ransomware group: payoutsking
• Country: Germany
• Sector: Manufacturing
• Announcement date: July 7, 2025

German manufacturer KOLBUS targeted by payoutsking group

The Germany-based manufacturing company KOLBUS has been listed on a leak site by the threat actor group known as payoutsking. According to the announcement made on July 7, 2025, the group claims to have successfully exfiltrated a significant volume of data from the organization. The attack is claimed to have occurred on June 16, 2025.

Details of the alleged data breach

The payoutsking group has posted the listing on their leak platform, claiming to have obtained 6.6TB of data from the target. In their announcement, the group identifies KOLBUS as a firm operating within the manufacturing sector with an annual revenue of $271 million. The group claims that the data has been leaked and has provided download links for the alleged files.

Regarding the specific contents of the breach, the exact nature of the leaked data is not specified, although a total volume of 6.6TB is mentioned. The listing does not name any specific data types.

About KOLBUS

KOLBUS is a German-based engineering company that manufactures high-performance machines and system solutions for the packaging and bookbinding industries. The company specializes particularly in corrugated board processing and luxury packaging production.

Impact and security considerations

This incident may have negative implications for the company's operational continuity and commercial reputation. As the company is based in Germany, the leak could potentially lead to data protection violations under GDPR. Depending on the content of the data, the exposure of employee or customer information might result in identity theft and targeted phishing attacks.

Information regarding this group is limited, and their activities should be monitored closely. Ransomware groups often employ double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations. By threatening to release this information on public leak sites, attackers aim to maximize pressure on the victim organization.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular network segmentation to prevent lateral movement by attackers. Continuous monitoring of threat intelligence is also essential to stay ahead of evolving group tactics.