Soapeople listed on Payoutsking leak site following alleged data breach

• Ransomware group: Payoutsking
• Country: Belgium
• Sector: Technology
• Announcement date: January 14, 2026

Payoutsking claims massive data exfiltration from Soapeople

The technology company Soapeople has been listed on the leak site of the threat group Payoutsking. According to the announcement made on January 14, 2026, the threat actor claims to have exfiltrated 1.5TB of corporate and personal data from the organization.

The Payoutsking group has published data they claim belongs to Soapeople on their leak platform. The threat actor alleges that they obtained the 1.5TB of data following an incident they state occurred on November 25, 2025. The group claims to have gained access to the company's networks and exfiltrated customer data from those systems.

In modern cyberattack scenarios, ransomware groups often employ a tactic known as double extortion. In this model, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to leak this stolen data on public platforms, the attackers increase the pressure on the organization to pay a ransom, leveraging the threat of reputational damage and regulatory scrutiny.

Alleged data types and contents

The leak involves a wide variety of sensitive information. The group alleges that the following types of data have been compromised:

• Corporate confidential documents
• NDAs
• Contracts
• Customer information
• Financial documents
• Payrolls
• Employee PII
• Corporate correspondence
• Identification documents

The announcement includes screenshots that reportedly show samples of identification documents and various other records. The breadth of this alleged data suggests a significant compromise of both administrative and operational information within the company.

Impact and potential risks

This alleged data leak may increase the risk of identity theft or targeted phishing attacks for Soapeople employees and customers. Given that the company is based in Belgium, the leaked data may fall under GDPR regulations, potentially leading to legal consequences. The claim of access to customer networks may create secondary risks regarding supply chain attacks.

Information about the Payoutsking group is limited. It is possible that the company's financial and operational processes may be negatively impacted by this event. When an organization's internal networks are breached, the ripple effects can extend far beyond the immediate loss of data, potentially affecting the trust and security of their entire client base.

For organizations operating in the technology sector, such incidents highlight the necessity of robust defensive measures. Common defensive steps include implementing multi-factor authentication (MFA), maintaining strict network segmentation to prevent lateral movement by attackers, and conducting regular security awareness training to mitigate phishing risks. Furthermore, continuous monitoring of network traffic and maintaining comprehensive, offline backups are essential components of a resilient cybersecurity posture. As attackers continue to target high-value data, the ability to detect and respond to unauthorized access quickly remains a critical priority for modern enterprises.