Eyemart Express Listed by payoutsking Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 30, 2026, the ransomware group payoutsking listed Eyemart Express on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of individuals affected has not been disclosed, and no further details about the scope or method of the incident have been made public. The practical implications for customers and staff of the optical retailer remain unclear because the contents of the claimed files have not been described. People who have received eye exams, purchased prescription lenses, or provided contact information to the company may face uncertainty about whether personal records were among the material referenced in the listing.

Inside the incident

Public information about the event is limited to the April 30, 2026 listing by payoutsking. The group claims internal files were taken during a ransomware operation, but it has not published additional evidence or a timeline of events. The number of people whose information may be involved is unknown, and Eyemart Express has not issued a statement confirming or describing the incident.

Inside payoutsking

Payoutsking is a ransomware actor that maintains a public leak site to list organizations it claims to have targeted. Such groups commonly encrypt systems and threaten to release stolen data if a ransom demand is not met. The listing of Eyemart Express constitutes the group’s claim that files were removed; independent confirmation of the claim has not been reported.

Eyemart Express and its sector

Eyemart Express is a United States-based retail optical chain founded in 1990 and headquartered in Farmers Branch, Texas. The company operates hundreds of stores nationwide and provides eye exams, frames, and lenses with an emphasis on rapid service. Retail optical providers routinely collect customer names, addresses, prescription details, insurance information, and payment card data in the course of their operations.

What data was at risk

The only description provided is that internal files were allegedly exfiltrated. Specific data types have not been disclosed. Organizations in this sector typically hold customer records that can include contact information, medical prescription data, and financial details, yet the exact contents of the material referenced in the listing remain unconfirmed.

Why it matters

Exposure of internal files from a retail healthcare provider can create downstream risks for individuals whose records were stored in those systems. Potential consequences include misuse of personal or financial information and complications for anyone whose prescription or insurance data appears in the material. For the organization, the incident adds to the operational and regulatory pressures already faced by companies that handle sensitive customer records.

If your data was in this claimed breach

Individuals concerned about possible exposure should monitor their financial accounts and credit reports for unusual activity. Changing passwords for any accounts linked to Eyemart Express and enabling multi-factor authentication where available are standard first steps. Readers can also run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.