Welldyne Data Breach

Welldyne, a healthcare organization based in the United States, was identified as a victim of the payoutsking ransomware group. The listing was published on July 7, 2026, according to SOCRadar’s Dark Web Monitoring service. The healthcare sector is often targeted due to the sensitive nature of patient data and the critical need for continuous service. Welldyne’s inclusion on the payoutsking portal places it within a recent cluster of victims attributed to this ransomware group. payoutsking has claimed two other victims in the 60 days preceding this listing, primarily targeting the healthcare and manufacturing sectors. Their victims have been located in the United States and Italy. While the group’s victimology is still developing, Welldyne’s profile aligns with the emerging trend of targeting North American entities.

SOCRadar’s analysis of stealer-log telemetry revealed a significant exposure related to the welldyne.com domain, with 25 credential records identified. These credentials were for customer- or patient-facing portal accounts, not corporate employee logins or third-party service accounts. No high-value endpoints like identity, mail, or VPN were flagged. The nature of these exposed records suggests a risk of customer-account takeover or supplier risk rather than a direct corporate intrusion. The exposure period spans from approximately March 2026 to early July 2026, indicating a sustained vulnerability. For ransomware groups like payoutsking, credentials obtained through information-stealing malware are a common initial access vector. Threat actors acquire fresh logs, validate corporate credentials, and use them to access systems such as Microsoft 365, VPNs, or remote access portals to deploy ransomware. While the stealer-log evidence in this case does not directly confirm a link to the payoutsking listing, it highlights a risk of customer-account fraud. CTI teams are advised to monitor for corporate credential exposure and enforce credential rotation for any affected portal accounts.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.