Eyemart Express listed on Payoutsking leak site

• Ransomware group: Payoutsking
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: April 30, 2026

Payoutsking claims data breach at Eyemart Express

The threat actor group known as Payoutsking has officially listed the United States-based retailer Eyemart Express on its dedicated leak site. According to the announcement made on April 30, 2026, the group claims to have successfully exfiltrated a significant amount of data belonging to the organization. The group alleges that the breach occurred on February 19, 2026, and involves a total dataset size of 435 GB.

This type of announcement is a hallmark of modern ransomware operations. In these scenarios, threat actors typically employ a double extortion tactic. This method involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive information beforehand. The attackers then use the threat of leaking this stolen data on public forums to exert maximum pressure on the victim to pay a ransom. While the specific ransom demand for this incident has not been disclosed, the threat of publishing the stolen dataset remains a primary tool for the group's extortion attempts.

Details of the alleged incident

According to the claims made by Payoutsking, the incident involved both the exfiltration and the encryption of Eyemart Express's data. The group has threatened to publish the full dataset, which is estimated to be 435 GB in size, if their demands are not met. The announcement suggests that the breach took place several months prior to the public listing on the leak site.

The contents of the stolen data, as claimed by the attackers, are highly sensitive and include various forms of personally identifiable information (PII). The group asserts that the stolen files contain:

• Customer records, including dates of birth, addresses, and phone numbers
• Scanned personally identifiable information (PII) belonging to employees

The presence of scanned documents and detailed personal records significantly increases the severity of the alleged breach, as these files are often used in fraudulent activities.

About Eyemart Express

Eyemart Express is an optical retail chain headquartered in the United States. The company operates within the retail and e-commerce sector, specializing in optical services. Their business model involves providing a variety of eye health products to consumers, including eyeglasses, sunglasses, and contact lenses.

Impact and industry implications

The alleged theft of such a large volume of data poses significant risks to both the organization and the individuals involved. For the customers and employees of Eyemart Express, the exposure of sensitive information such as addresses, phone numbers, and scanned PII significantly increases the risk of identity theft. Furthermore, such data is highly valuable for conducting targeted phishing attacks, where attackers use specific personal details to gain the trust of victims.

From a regulatory and legal perspective, because Eyemart Express is based in the United States, a confirmed breach of this nature could trigger various state-level data protection regulations. This may lead to mandatory data breach notification requirements, potential legal proceedings, and administrative sanctions. Additionally, the organization faces the risk of substantial reputational damage resulting from the public disclosure of the theft.

In the retail and e-commerce sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Organizations in this sector often handle vast amounts of sensitive customer data, making them prime targets for ransomware groups. To mitigate these risks, companies typically focus on implementing strong access controls, continuous monitoring, and comprehensive data encryption strategies. Furthermore, maintaining a rapid incident response plan and ensuring regular backups are essential components of a modern defensive posture against double extortion tactics.