EvoluPharm listed on payoutsking leak site

• Ransomware group: payoutsking
• Country: France
• Sector: Healthcare
• Announcement date: July 7, 2025

The French-based healthcare organization EvoluPharm has been listed on a leak site by the threat actor group known as payoutsking. According to the announcement made on July 7, 2025, the group claims to have successfully targeted the organization, potentially involving an incident that occurred as early as May 12, 2025.

Details of the claimed attack

The payoutsking group has published an announcement on their leak site claiming responsibility for the breach. The group asserts that they have obtained a significant amount of data belonging to EvoluPharm. Specifically, the attackers claim to have stolen 858GB of data from the organization. To demonstrate the validity of their claim, the group has provided download links and stated that the stolen data is currently accessible to those who seek it.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on public platforms, these groups aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. While the specific details regarding the ransom demand were not provided in the announcement, the presence of the data on a leak site is a hallmark of this extortion tactic.

Data involved in the incident

The exact nature and specific types of the leaked data have not been specified by the threat actors. Because the listing does not provide a detailed breakdown of the files, the specific categories of information remain unknown. However, given the organization's presence and operations within the healthcare sector, there is a possibility that the data may contain sensitive information.

• No specific data types were listed in the announcement.

When organizations face such incidents, the lack of clarity regarding the stolen data types can create significant uncertainty. The absence of information regarding the exact file count or the specific nature of the contents makes it difficult to immediately assess the full scope of the exposure.

About EvoluPharm

EvoluPharm is a healthcare company based in France. The organization provides a wide range of products, services, and logistics solutions specifically designed for pharmacies. Their business model focuses on offering various products intended to help pharmacists optimize their professional business processes.

Risk assessment and industry implications

This situation carries the potential risk of exposing personal data belonging to the organization. Since EvoluPharm operates within France, the incident may require evaluation under the General Data Protection Regulation (GDPR) and may necessitate reporting to the relevant regulatory authorities. Such regulatory compliance is a standard requirement when personal data is potentially compromised.

The leak of data can lead to various secondary risks. For employees and patients, the exposure of information could potentially lead to identity theft or the occurrence of targeted phishing attacks. In the healthcare sector, where data sensitivity is often high, these risks are a primary concern for security professionals.

Regarding the threat actor, information concerning the payoutsking group remains limited. The impact of this incident may be observed through negative effects on the organization's operational processes. To mitigate such risks, organizations in the healthcare sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring, and ensuring regular backups are maintained. Furthermore, maintaining an incident response plan and ensuring compliance with regional data protection regulations are essential steps for managing the aftermath of a potential breach and minimizing operational disruption.