Thompson+Hanson targeted by Payoutsking ransomware group

• Ransomware group: Payoutsking
• Country: United States
• Sector: Professional Services
• Announcement date: July 21, 2025

Payoutsking claims data breach at Thompson+Hanson

The threat actor group known as Payoutsking has listed a significant amount of data on their leak site, which they claim belongs to Thompson+Hanson. According to the announcement made on July 21, 2025, the group alleges that the data was obtained through an attack that occurred on July 14, 2025. While the claim has been made public on the group's portal, the specific details regarding the breach remain limited to the assertions made by the threat actors.

The Payoutsking group has provided a portion of the data as proof of their claims. In their announcement, the group asserts that Thompson+Hanson maintains an annual revenue of approximately $27 million. Information regarding the specific identity, methods, or background of the Payoutsking group remains limited in the public domain, making it difficult to ascertain more about their specific operational patterns beyond this incident.

Details of the alleged data leak

The scope of the alleged theft is substantial, with the threat actor claiming that the total volume of the data involved is 995 GB. Despite the large size of the data set, the group has not disclosed the specific nature or the exact types of files that have been compromised. The listing does not name any specific data types or categories of information that were allegedly stolen during the incident.

In modern ransomware campaigns, threat actors often employ a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive information. The threat of publishing this stolen data on a public leak site is used as leverage to pressure the victim into paying a ransom. If the ransom is not met, the attackers threaten to release the data, which can lead to severe consequences for the victim organization.

About Thompson+Hanson

Thompson+Hanson is a professional services firm based in Texas, United States. The company specializes in land management, title research, and mineral rights. They primarily serve the oil and gas industry, managing the complex processes required for securing and administering the land rights that are necessary for various energy projects.

Potential risks and organizational implications

This alleged data leak may pose significant risks to the operational continuity and commercial reputation of Thompson+Hanson. Because the organization is based in the United States, the presence of any personal or financial information within the leaked data could trigger various legal obligations. Specifically, such a breach could activate state-level data breach notification laws as well as federal regulations.

The publication of such data can lead to secondary risks for both employees and clients of the organization. These risks include the potential for identity theft or the execution of highly targeted phishing attacks using the stolen information. When attackers possess specific details about a company's operations or its clients, they can craft much more convincing social engineering campaigns.

For organizations operating in the professional services sector, particularly those handling sensitive land and energy rights, maintaining robust cybersecurity defenses is critical. Common defensive steps for organizations include implementing strict access controls, maintaining regular offline backups, and conducting comprehensive employee training to recognize phishing attempts. Furthermore, organizations must be prepared for the legal and financial pressures that arise from the threat of data publication through double-extortion tactics used by ransomware groups.