cyfenced.com →

[ Ransomware claim · payoutsking · 24 Oct 2026 ]

Merical LLC

The ransomware group payoutsking named Merical LLC (United States) on its leak site on 24 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Not confirmed so far

[ Status ]Has the attack been confirmed?

We have found no statement from Merical LLC and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.

[ The organisation ]Who is Merical LLC?

What it does
MeriCal is a contract developer and manufacturer of dietary supplements and probiotics in the United States. It provides research and development, formulation, manufacturing, packaging and labelling, and quality control for supplement brands, including gummies, probiotics, tablets, capsules and powders.
Based in
Anaheim, Orange County, California, United States
Founded
1965
Size
nearly 550 workers at six US sites after its 2017 acquisition of Global Health Industries
Who it serves
Supplement brands and retailers that sell vitamins, probiotics and other nutritional products under their own labels. A 2016 report said its customers included many of the world's most recognised retailers and supplement brands.

Partners and customers it names publicly

  • Linden Capital Partners, private equity owner since 2016
  • Global Health Industries, Ogden, Utah probiotics maker acquired by MeriCal in 2017

[ Impact ]Who could be affected

A disruption at a contract manufacturer could delay production and shipments of supplement products for the brands and retailers that rely on it, which could lead to stock shortages. Brand customers could also face exposure of formulations, orders or business contacts, and staff could be affected if employee records were involved.

In this kind of organisation generally: Customers, employees and partners can be affected: services can be interrupted, and personal or business data the organisation holds can be threatened with publication.

[ The attacker ]About payoutsking

Payouts King is a data-extortion ransomware group active since 2025 that security researchers link to former Black Basta affiliates. It is reported to gain access through spam bombing followed by fake IT support calls on Microsoft Teams and Quick Assist, steal data, disable backups and then encrypt systems.

payoutsking has claimed 5 organisations in the last 30 days, most in United States, and mostly in other, manufacturing and healthcare.

payoutsking on Ransomware.live

Other organisations payoutsking has named

[ What to do ]If you are a customer, partner or neighbour

  1. Brand customers should contact their MeriCal account manager for an update on production schedules and any effect on open orders.
  2. Verify any change to invoicing or bank details by phone using a known contact before making payments.
  3. Be cautious with unexpected emails or Teams calls claiming to be from MeriCal or from IT support.
  4. Review what product, regulatory and contact information you share with the manufacturer and whether any shared access needs to be reset.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.