Sofinter S.p.a listed on Payoutsking ransomware leak site

• Ransomware group: Payoutsking
• Country: Italy
• Sector: Professional Services
• Announcement date: April 30, 2026

Sofinter S.p.a targeted by Payoutsking ransomware group

The Payoutsking ransomware group has listed the Italian professional services firm Sofinter S.p.a on its dedicated leak site. According to the group's announcement, the cyberattack resulted in a significant data breach involving a dataset claimed to be 2TB in size.

Details of the alleged attack

The threat actor behind the Payoutsking group alleges that they successfully breached the corporate networks of Sofinter S.p.a. The group claims that the intrusion and subsequent encryption of data occurred on February 24, 2026. Following the initial breach, the attackers claim to have exfiltrated a massive amount of information, which they assert includes both financial and operational data belonging to the organization.

Ransomware attacks of this nature often follow a pattern known as double extortion. In this scenario, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data before the encryption process is complete. The group then threatens to publish this stolen information on a public leak site if their demands are not met. This tactic places immense pressure on organizations, as the exposure of stolen data can lead to severe reputational damage, legal consequences, and operational risks that persist long after the initial encryption has been remediated.

Data types and information involved in the breach

The leak announcement provided by the Payoutsking group specifies a wide array of sensitive information that has allegedly been compromised. The stolen data is said to include various types of corporate and personal records. According to the group's claims, the following data types are included in the breach:

• Employee PII
• Executive PII
• Customer data
• Financial data
• Contracts
• Engineering drawings

Beyond these categories, the group claims the dataset contains corporate correspondence, non-disclosure agreements (NDAs), quality assurance (QA) department data, payroll files, budget documents, and other various corporate documents. To support their claims, the group has provided screenshots displaying samples of identification cards and other corporate documentation.

The organization profile

Sofinter S.p.a is an Italian company specializing in the design, manufacturing, and installation of steam boilers and energy systems for power generation and industrial processes. The company provides turnkey solutions for power plants and waste-to-energy facilities.

Potential impact and industry implications

The exposure of this information carries significant risks for both the organization and the individuals involved. The theft of personally identifiable information (PII) belonging to employees and executives increases the risk of identity theft and makes these individuals targets for highly specific, targeted phishing attacks. Furthermore, the loss of confidential corporate information and engineering drawings could potentially harm the company's competitive advantage and weaken the security of its supply chain.

Because Sofinter S.p.a is based in Italy, the exposure of this data may fall under the scope of the European Union's General Data Protection Regulation (GDPR), which could potentially lead to legal sanctions for the organization. The group's continued use of double-extortion tactics highlights the evolving nature of ransomware threats where data privacy is used as leverage.

For organizations operating in the professional services and industrial engineering sectors, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive measures often include implementing strict access controls, maintaining offline backups, and conducting regular network monitoring to detect unauthorized exfiltration. Additionally, organizations must be prepared to fulfill legal obligations regarding data breach notifications to inform affected parties and regulatory bodies when sensitive information is compromised.