Casta Diva Group Data Breach

SOCRadar’s Dark Web Monitoring service identified that Casta Diva Group, an Italy-based company operating in the hospitality and tourism sector, was listed on the PayoutsKing ransomware group’s leak portal on July 14, 2026. PayoutsKing is known for targeting Italian organizations and has a relatively low victim count. Casta Diva Group’s business, which involves events and hospitality production, is susceptible to significant financial losses due to downtime.

Initial analysis using SOCRadar’s stealer-log telemetry revealed a limited exposure related to Casta Diva Group, with a single employee credential found for the organization’s webmail service (webmail.castadivagroup[.]com) in mid-June 2026. This type of credential could potentially grant direct access to internal mail and subsequent systems. While this specific credential’s use by PayoutsKing is not confirmed, it aligns with common initial access tactics where threat actors leverage stolen credentials from stealer logs to gain entry into targeted networks via webmail, VPN, or remote access portals before deploying ransomware.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.