Soja de Portugal targeted by thegentlemen ransomware group

• Ransomware group: thegentlemen
• Country: Portugal
• Sector: Agriculture and Food Production
• Announcement date: June 4, 2026

Thegentlemen claims data leak from Soja de Portugal

The ransomware group known as thegentlemen has claimed responsibility for a significant data breach targeting Soja de Portugal. According to an announcement posted on a leak site on June 4, 2026, the threat actor group alleges that they have successfully exfiltrated a large volume of sensitive information belonging to the Portuguese organization.

The group claims that the cyberattack occurred on June 3, 2026. In their public statement, thegentlemen alleges that the organization chose to respond to the incident with threats rather than engaging in negotiations. Furthermore, the attackers claim that the company has failed to report the breach to the relevant authorities or parties involved.

Details of the claimed data exfiltration

While the group has not provided any screenshots to verify their claims, they assert that the breach involves a substantial amount of data. Specifically, the group claims to have stolen 491 GB of information. The contents of the stolen data, as described by the attackers, include a wide variety of sensitive corporate and personal records.

The specific types of data allegedly compromised include:

• SAP data
• Personal data
• Employee data
• Customer data
• Partner data
• Financial data
• Contracts
• Logistics data
• Production data
• Corporate correspondence

The breadth of this alleged data set suggests a comprehensive compromise of the organization's digital environment, spanning from core business processes to sensitive human resources and financial information.

About Soja de Portugal

Soja de Portugal is a prominent company based in Portugal that operates within the agriculture and food production sector. The organization specializes in the processing and production of both animal and vegetable proteins. As a key player in its industry, the company manages several established brands, including Sorgal, Avicasal, and Savinor. Its operations provide essential services across both the feed production and food processing sectors.

Potential implications and industry risks

This alleged breach carries significant secondary risks for the organization, its employees, and its customers. The exposure of personal and employee data can lead to identity theft or the execution of highly targeted phishing attacks against the affected individuals. Such social engineering tactics often follow large-scale data leaks, as attackers use the stolen information to gain trust and further penetrate networks or defraud individuals.

Because the organization is located in Portugal, the exposure of personal data may trigger specific legal obligations under the GDPR (EU General Data Protection Regulation), potentially leading to administrative sanctions. Additionally, the disclosure of financial records and commercial contracts could damage the organization's competitive standing and erode the trust established with business partners.

In the broader context of modern cyber threats, this incident reflects the