Maderas del Alto Urgel listed on Payoutsking ransomware leak site

• Ransomware group: Payoutsking
• Country: Spain
• Sector: Manufacturing
• Announcement date: April 30, 2026

Payoutsking claims data breach at Maderas del Alto Urgel

The Payoutsking ransomware group has listed the Spanish manufacturing company Maderas del Alto Urgel on its dedicated leak site. According to the announcement made on April 30, 2026, the threat actors claim to have successfully breached the organization's systems and encrypted their data. The group asserts that they have exfiltrated a significant volume of information, specifically claiming to have stolen 218 GB of data belonging to the company.

To substantiate their claims regarding the compromise of operational and personal data, the threat actors have shared sample files as part of their public announcement. This tactic is a hallmark of modern ransomware operations, where attackers use proof of access to increase pressure on the victim. While the group claims the breach occurred around January 14, 2026, the information remains a claim made by the threat actors on their platform.

Data types and information involved in the leak

The Payoutsking group has identified several categories of sensitive information that they claim to have acquired during the breach. The leaked data is said to encompass a wide range of corporate and personal records, which could have significant implications for both the company and the individuals involved. The specific types of data mentioned in the claim include:

• Employee PII
• Customer data
• Financial data
• Corporate correspondence

The scope of the stolen information is broad, reportedly including database exports containing customer information, payrolls, budgets, and invoices. Furthermore, the claim suggests that corporate confidential correspondence and sensitive financial data were among the files targeted during the intrusion.

About Maderas del Alto Urgel

Maderas del Alto Urgel is a company based in the Catalonia region of Spain. The organization specializes in timber production and wood processing. As a key player in its sector, the company supplies various wood products to support the needs of the construction and furniture industries.

Analysis and potential implications of the breach

The use of double extortion tactics by the Payoutsking group—where data is both encrypted and stolen to be used as leverage—suggests a calculated attempt to exert maximum pressure on the organization. This method is designed to ensure that even if a company can restore its systems from backups, the threat of leaking sensitive information remains a powerful tool for the attackers.

This specific breach may pose significant secondary risks to the company's stakeholders. For the employees and customers whose data has been compromised, there is an increased risk of identity theft and targeted phishing attacks. Furthermore, the exposure of financial data and payrolls could lead to the disclosure of trade secrets, potentially damaging the company's competitive advantage in the manufacturing market.

From a regulatory perspective, since the company operates in Spain, it is likely that they may face administrative sanctions under the General Data Protection Regulation (GDPR) for failing to meet necessary data protection obligations. The potential for legal and regulatory consequences adds another layer of risk to the incident.

In general, organizations operating in the manufacturing sector can take various defensive steps to mitigate such risks. Implementing robust access controls, maintaining regular offline backups, and conducting comprehensive employee training on phishing awareness are standard industry practices. Additionally, monitoring for unauthorized data exfiltration and maintaining a strong incident response plan can help organizations react more effectively when a breach is detected.