Qualiflex Datacenter Data Breach

Qualiflex Datacenter, a technology organization based in Switzerland, has been listed as a victim on the Payload ransomware group’s dark web portal, published on August 20, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Qualiflex Datacenter operates in Switzerland’s managed data center and hosting services market. The Payload group’s listing appears to encompass multiple associated entities, including educational institutions linked to Qualiflex’s infrastructure — a disclosure pattern that may indicate a hosted-environment or supply chain dimension to the compromise. In the 60 days prior to this listing, Payload has claimed 13 other victims across its leak portal. The group has shown a strong targeting pattern in the Technology, Manufacturing, and Business Services sectors. Geographically, its victims are concentrated in Switzerland, Germany, and Jordan. Other recent Payload listings that include Swiss technology organizations include Baya Technologies, Software Arge, and Stücheli Architekten. Qualiflex Datacenter is consistent with Payload’s demonstrated focus on Swiss technology and services infrastructure.

Initial-access correlation against SOCRadar’s stealer-log telemetry surfaced a severe exposure for an associated domain (fh-hwz.ch), which belongs to an educational institution linked to the victim’s infrastructure. This coverage note is relevant: the stealer-log query was run against fh-hwz.ch rather than a corporate datacenter domain, which limits the inference that can be drawn about Qualiflex’s internal employee exposure specifically. The sample returned 25 records spanning identity and SSO infrastructure, including Active Directory Federation Services (ADFS), Microsoft Online, and the institution’s federated identity portal (eduid). Records include student-format credentials (@student.fh-hwz.ch), reflecting that the queried domain is primarily an educational entity’s identity infrastructure rather than a datacenter’s corporate workstation environment. The dominant exposure profile for this queried domain is student/institutional identity risk. For ransomware groups such as Payload, infostealer-harvested credentials are a well-documented initial access vector: operators or initial access brokers source fresh logs from underground marketplaces, validate the corporate credentials, and use them to log into Microsoft 365, VPN, or remote-access portals before deploying ransomware. The absence of employee-specific corporate credential evidence in this query does not exonerate Qualiflex Datacenter’s own internal systems — the datacenter’s own employee credentials may exist under a different domain, not queried in this telemetry run. CTI teams should assess whether any institutional accounts on fh-hwz.ch had administrative or hosted-infrastructure access.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.