Soja de Portugal Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Soja de Portugal was listed by the ransomware group thegentlemen on or around 4 June 2026. The listing states that 491 GB of internal files were taken from the organisation and placed on the group’s data-leak site. No figure has been published for the number of individuals whose information may be included. The exact circumstances of the intrusion, including when access began or how the files were obtained, remain undisclosed in public reporting.

What happened

Thegentlemen listed Soja de Portugal on its leak site and stated that 491 GB of data had been removed. The group posted a link to a directory containing the material rather than entering ransom negotiations. No official statement from Soja de Portugal confirming or denying the claims has been recorded, and the company has not disclosed whether it notified regulators or affected individuals.

Public records do not yet contain an independent verification of the volume or contents of the material. The only confirmed detail is the group’s assertion that the files were taken during a ransomware operation.

Inside thegentlemen

Thegentlemen is a ransomware operator that maintains a public site to list organisations from which it claims to have stolen data. Groups of this type typically exfiltrate files first and then threaten publication if payment demands are not met. In this instance the group posted the material directly and made threats instead of continuing negotiations.

The listing itself constitutes the group’s claim; no independent confirmation of the theft or of the group’s subsequent actions has been published.

About Soja de Portugal

Soja de Portugal operates in the Portuguese agricultural and food-processing sector. Companies of this kind routinely maintain records covering supply-chain planning, production processes, customer and partner contracts, financial transactions and employee information. A breach affecting such an organisation can therefore touch both commercial operations and personal data held about staff, customers and suppliers.

The information in question

The group’s listing describes the material as internal files that include SAP data, contacts, contracts, planning documents, logistics records, project files, personal data, employee data, partner and customer information, financial data, correspondence, production data, quality-control records, offers and proposals, and material related to brands such as Sorgal, Avicasal and Savinor. The precise contents of the 491 GB archive have not been independently verified.

Why it matters

Exposure of employee, customer and financial records can lead to identity misuse, targeted fraud or further social-engineering attacks against the same individuals. For the organisation, the release of production, logistics and contract data may create competitive or regulatory consequences. Because the number of people affected remains unknown, the full scope of personal risk cannot yet be assessed.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit-reference agencies. Change passwords for any accounts that may have been reused across systems. Individuals can run a free exposure scan of their email address against known breach data sets to check whether their information appears in publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.