Payload Ransomware Claims Breach of Royal Bahrain Hospital On March 15, 2026, the Payload Ransomware group announced it had compromised Royal Bahrain Hospital (RBH), a prominent 70-bed healthcare facility in Bahrain. The attackers claim to have exfiltrated 110 GB of sensitive data, which they displayed on their Tor-based leak site as proof of the breach. The group has set a March 23 deadline, threatening to release the stolen data if the ransom is not paid. RBH, established in 2011, provides inpatient and outpatient services including surgery, maternity care, and diagnostics to patients across Bahrain and neighboring Gulf nations such as Oman, Qatar, Saudi Arabia, and the UAE. Payload Ransomware, a relatively new operation, employs a double-extortion model, encrypting files while also stealing data to pressure victims. The group primarily targets mid- to large-sized organizations in sectors like real estate and logistics, often in emerging markets. Its ransomware uses ChaCha20 encryption and Curve25519 key exchange, while disabling security tools and deleting shadow copies to hinder recovery. Like many modern ransomware crews, Payload likely operates as a ransomware-as-a-service (RaaS) scheme, leveraging a Tor leak site to expose non-compliant victims.