EvoluPharm Listed by payoutsking Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized companies in regulated industries across Europe, using data theft and public leak-site listings as leverage. In this landscape, pharmaceutical service providers that sit between manufacturers and community pharmacies have become attractive targets because of the operational and personal data they routinely handle.

On 12 May 2025, EvoluPharm, a French pharmaceutical-sector company, appeared on a listing published by the ransomware group known as payoutsking. The group claims to have conducted a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and public detail about the precise scope of the incident is limited.

What happened

According to the available record, EvoluPharm was listed by the payoutsking ransomware group on 12 May 2025. The listing asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been publicly disclosed. The number of individuals whose information may have been involved is also unknown. At present the listing itself constitutes an unverified claim by the threat actor; independent confirmation of the full extent of the incident has not been published in the material available for this report.

Who is payoutsking?

Payoutsking is a ransomware operation that has appeared in public threat-intelligence reporting as a group that combines encryption of victim systems with the theft of data. Like many contemporary ransomware crews, it typically posts victim names and sample files on a dedicated leak site to increase pressure for payment. The group’s public activity has focused on organisations across multiple sectors rather than a single industry. Its listings are claims made by the operators themselves; they do not automatically prove that every asserted detail is accurate or that every claimed file set was in fact obtained. In this case, the only specific assertion tied to EvoluPharm is the claim of internal-file exfiltration during a ransomware attack.

Who is EvoluPharm?

EvoluPharm operates in France’s pharmaceutical sector. Public descriptions characterise it as a company that supplies generic and specialty pharmaceuticals together with management tools, marketing solutions and training aimed at community pharmacists. Its model emphasises digitisation of pharmacy operations and environmentally conscious practices. Organisations of this type commonly maintain commercial records, supplier and customer contact details, inventory and pricing data, and, in some cases, information linked to healthcare professionals or pharmacy staff. Because pharmacies sit at the intersection of patient care and regulated product distribution, a compromise of a service provider such as EvoluPharm can have ripple effects beyond the company itself.

What data was at risk

The only data category named in the public record is “internal files” said to have been exfiltrated. No inventory of specific file types, databases or record counts has been released. Companies operating in the pharmaceutical-services space typically hold commercial contracts, product catalogues, employee and partner contact information, and operational documents. Whether any of those categories—or more sensitive material—were among the files claimed by payoutsking remains unconfirmed. The exact contents of the alleged exfiltration are therefore unknown.

The real-world impact

For individuals whose information may have been present in the internal files, the principal risks are those that follow any unauthorised disclosure of business or professional data: possible phishing or social-engineering attempts that reference legitimate commercial relationships, and, if contact details or identifiers were included, an elevated chance of targeted fraud. For EvoluPharm itself, the consequences can include operational disruption, regulatory scrutiny under European data-protection rules, contractual obligations to notify partners, and reputational damage within the pharmacy network it serves. Because the number of affected people and the precise data types remain undisclosed, the scale of these risks cannot yet be quantified from public sources.

If your data was in this claimed breach

If you have a professional or commercial relationship with EvoluPharm or with pharmacies that use its services, treat any unexpected communication that references the company with caution. Change passwords on related accounts, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Keep records of any suspicious contacts and report them to the appropriate authorities if fraud is suspected. Further official statements from EvoluPharm or French regulators, if issued, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.