cyfenced.com →

[ Ransomware claim · payoutsking · 24 Oct 2026 ]

Morrow Meadows Corporation

The ransomware group payoutsking named Morrow Meadows Corporation (United States) on its leak site on 24 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Not confirmed so farOther

[ Status ]Has the attack been confirmed?

We have found no statement from Morrow Meadows Corporation and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.

[ The organisation ]Who is Morrow Meadows Corporation?

What it does
Morrow-Meadows Corporation is an electrical, technology systems and energy contractor working on commercial and industrial projects, from new builds to facility maintenance. It has an in-house engineering department and a data communications and low-voltage division, and works in sectors such as healthcare, data centres, energy, entertainment, transportation and education.
Based in
City of Industry, California, United States
Founded
1964
Size
More than 2,000 employees, with branches in California, Washington and Oregon
Who it serves
It serves building owners and general contractors on commercial, industrial and public projects across California, Oregon, Washington, Nevada and Arizona, including hospitals, stadiums, studios and airports.

Partners and customers it names publicly

  • Kaiser Permanente, Client named on the company website
  • Turner Construction, General contractor named on the company website
  • Swinerton, General contractor named on the company website
  • Hensel Phelps, General contractor named on the company website
  • Hoffman Construction, General contractor named on the company website

[ Impact ]Who could be affected

General contractors and building owners could see delays to electrical work, bids or project documents if company systems were disrupted. Employees and business partners could be at risk of targeted phishing or invoice fraud if contact or payment details were exposed.

In other generally: Customers, employees and partners can be affected: services can be interrupted, and personal or business data the organisation holds can be threatened with publication.

[ The attacker ]About payoutsking

PayoutsKing is an extortion group active since mid-2025 that Sophos says does not use affiliates. It has been reported to get in through SSL VPN devices, a SolarWinds Web Help Desk flaw or email bombing followed by fake IT support calls on Microsoft Teams, and copies data before encrypting systems.

payoutsking has claimed 5 organisations in the last 30 days, most in United States, and mostly in other, manufacturing and healthcare.

payoutsking on Ransomware.live

Other organisations payoutsking has named

[ What to do ]If you are a customer, partner or neighbour

  1. Confirm any request to change bank or payment details by phone using a number you already know, not one given in the message.
  2. Be wary of emails that appear to come from Morrow-Meadows project staff with unexpected attachments or links.
  3. Check project documents and drawings you receive through shared portals before opening them.
  4. Watch for a statement from the company about whether partner or employee information was involved.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.

[ Similar claims ]Other other organisations in United States