Ransomware victim disclosure
← All victimsSofinter S.p.a
Claimed by payoutsking · listed 21 days ago
Status timeline
- Listed
Apr 30, 2026
- Data leaked
At a glance
- Group
- payoutsking
- Status
- Data leaked
- Country
- IT
- Sector
- Business Services
- Listed on leak site
- Apr 30, 2026
About the victim
AI dossier — public-source company profileSofinter S.p.A. is an Italian industrial group headquartered in Milan, operating worldwide in the design and manufacturing of large industrial boilers for steam and energy production from coal, oil, gas, biomass, and waste. It serves the energy, oil and gas, petrochemical, and power generation sectors. The group comprises multiple highly specialised subsidiaries and serves both domestic and international markets.
- Industry
- Industrial Boilers & Thermal Energy Equipment Manufacturing
- Address
- Via Conservatorio, 17 – 20122 Milano, Italy
Attack summary
Severity: high — Data has been published by the threat actor, and the company itself issued a formal GDPR Article 34 public notification confirming a cybersecurity incident, indicating confirmed data exfiltration affecting personal data. The victim operates in critical industrial energy infrastructure sectors.The ransomware group 'payoutsking' claims to have attacked Sofinter S.p.A. with data published (disclosed status: data_published); the company itself published a cybersecurity incident notice on its website dated February 2026, confirming a security incident under GDPR Art. 34. The specific nature of exfiltrated data has not been detailed in the leak post.
Data the group says was taken
AI dossier — extracted from the leak post- Corporate business data
- Potentially GDPR-regulated personal data (implied by Art. 34 GDPR notification)
Original description
AI-summarised, not from the leak postSofinter S.p.A. is an Italian industrial company specializing in the design and manufacturing of heat recovery systems, boilers, and thermal energy equipment. Operating in the energy and power generation sector, it serves industries including oil and gas, petrochemical, and power plants. Headquartered in Italy, Sofinter provides engineering solutions focused on steam generation and waste heat recovery, supporting both domestic and international markets.
The leak post
captured from the group's sitePayoutsKing PayoutsKing Blog News About Partnership Welcome PK MAIN TOX: 535F403A2EA2DC71A392E18D7DB77FEF70845C0B7E5B9114CD30D301870304379C3547E324E2 Company Create Website Country Revenue Employees Actions Data Views Status H****l 2026-04-21 t****.com USA $786M ** Exfiltrated 860GB 0 Declared 1d 02:08 F****p 2026-04-14 fl****.com USA $2.7B ** Exfiltrated & Encrypted 1.1TB 0 Declared 1d 02:08 H****o 2026-04-01 has****.com USA $TBD ** Exfiltrated & Encrypted 4.8TB 0 Declared 1d 02:08 A****y 2026-03-31 ape****.com USA $309M ** Exfiltrated & Encrypted 3TB 0 Declared 2d 00:04 NTN Bearing Corporation of America 2026-04-24 ntnamericas.com USA $1.5B 4700 Exfiltrated 596GB 420 Proof 6d 02:09 About company: NTN Bearing is a producer of ball and roller bearings, with plants around the globe and a strong, domestic manufacturing network. Data description: Confidential, Employees' PII (Personally Identifiable Information), Correspondence, Financial, Engineering, Contracts, Agreements, NDA, FULL INFO SunSource 2026-04-20 sun-source.com USA $2B 3500 Exfiltrated 700GB 3401 Disclosed About company: SunSource is a distribution company, providing products, services, and information in…
Sources
Source
Indexed 21 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
