Tscherne Consulting Steuerberatung GmbH listed on payload ransomware leak site

• Ransomware group: payload
• Country: Austria
• Sector: Financial Services
• Announcement date: April 3, 2026

The Austrian tax consulting firm Tscherne Consulting Steuerberatung GmbH has been listed on the leak site of the ransomware group known as payload. The group has published an announcement claiming that they have successfully targeted the organization and obtained data from its systems.

The claimed attack and extortion activities

According to the announcement made on April 3, 2026, the payload group claims to have carried out an attack against Tscherne Consulting Steuerberatung GmbH. The group has asserted that they managed to exfiltrate a significant amount of information during the incident. This type of activity is a hallmark of modern ransomware operations, often referred to as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to demand a ransom for decryption; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on a public leak site, the attackers aim to pressure the victim into paying the ransom to prevent the exposure of confidential records.

The group has officially listed the organization on its dedicated leak site as part of its ongoing extortion activities. This public listing serves as a method of pressure, signaling to the victim and the public that the breach has occurred and that the stolen data is at risk of being released. While the group has claimed responsibility for the breach, the specific details regarding the method of entry or the exact timing of the initial intrusion remain undisclosed in the available information.

Details regarding the claimed data exfiltration

The payload group has specified the volume of the data they claim to have stolen from the organization. According to the group's announcement, the total size of the allegedly exfiltrated data is 104 GB. This volume of data suggests a substantial breach that could encompass a wide variety of digital assets and records held by the firm.

Regarding the specific types of information contained within the 104 GB of data, the group has not provided any specific details. The listing names no specific data types or categories of files that were allegedly compromised. However, given the nature of the firm's operations, the presence of financial and personal data may be possible. The lack of specific information regarding the content of the leak is common in early-stage ransomware announcements, where the primary goal is to establish the fact of the breach rather than to provide a detailed inventory of the stolen assets.

Organization profile

Tscherne Consulting Steuerberatung GmbH is a tax consulting firm based in Graz, Austria. The company provides services to small and medium-sized businesses, including bookkeeping, tax planning, payroll processing, and business consulting.

Potential risks and industry implications

This incident may pose a risk of exposing sensitive client data, which could lead to legal consequences under the General Data Protection Regulation (GDPR). Because the firm handles sensitive financial and personal information for small and medium-sized businesses, the potential impact of a data leak is significant. Furthermore, secondary risks such as identity theft and targeted phishing attacks against the firm's clients may be observed following such a breach.

Given the firm's role in tax consulting, it is possible that the leaked data includes trade secrets belonging to third-party businesses. The exposure of such information can damage the competitive standing of the clients and erode the trust essential to professional consulting services. The severity of the incident may vary depending on the actual nature and quality of the compromised data.

For organizations operating in the financial and professional services sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication (MFA), maintaining regular offline backups, and conducting regular security awareness training for employees to prevent phishing. Additionally, maintaining strict access controls and monitoring network traffic for unusual data exfiltration patterns are essential components of a proactive defense strategy to mitigate the risks posed by ransomware groups.