CKR Consulting Engineers listed by the Payload ransomware group

Overview

The Payload ransomware group has listed CKR Consulting Engineers, a Johannesburg-based engineering consultancy, on its leak site. The firm provides multi-disciplinary services in electrical, mechanical, civil and renewable energy engineering. The listing appeared on 19 July 2026.

What was published

The group claims to have accessed the consultancy's systems and copied project and corporate data. The expected contents include engineering drawings, project documentation, client records and employee information. The group has not yet published the archive.

Risks for affected individuals

• Clients' infrastructure and project details may be exposed.
• Employee personal data could be misused.
• Confidential designs may have commercial value for competitors.

What remains unknown

• The volume of exfiltrated data.
• Whether client intellectual property is included.
• The timeline of any public release.

What affected people should do

Clients should review the sensitivity of shared documents and consider notifying their own stakeholders. CKR should inform affected clients, secure the compromised environment, and follow South African data protection requirements for breach notification.