Our takePayoutsKing lists T****r on its leak site; the claim is now corroborated by two independent sources. If you run internet-exposed PTC Windchill or FlexPLM, take them offline and patch — this is the vector Clop affiliates are using for data theft.Cyber Resilience desk
Sources (13)
- california_ag · california_ag
- ransomware_live · ransomware_live
- hackernews · hackernews
- infosec_mag · infosec_mag
- bbc_tech · bbc_tech
- bleeping · bleeping
- helpnet · helpnet
- databreaches · databreaches
- databreaches · databreaches
- bleeping · bleeping
- helpnet · helpnet
- helpnet · helpnet
- report_desk · report_desk
What this means for you — Security leader:If your organization or a material partner matches this listing, activate IR and counsel, confirm whether exfiltration occurred, and map disclosure obligations against the corroborated claim. Otherwise treat it as third-party risk signal and watch for secondary fraud against your environment.
What this means for you — Lean IT orgs:Unless you are the listed organization, no direct patch or config action is required; if you do business with them, watch invoices, bank-detail changes, and phishing that leans on the claim. If this is your firm, call your incident contact and counsel before making any public statement.
What this means for you — MSP:Scan client rosters for a name match to the listed victim; on a hit, engage IR, preserve logs and backups, and hold client comms until facts are confirmed. No fleet-wide product action from this listing alone.
What this means for you — Researcher:Track payoutsking’s listing cadence and any victim statement, regulatory filing, or takedown that strengthens or weakens the corroborated claim. Note tooling and naming patterns for later campaign clustering.