Telia Norge AS Listed by payoutsking Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 21, 2026, the ransomware group payoutsking listed Telia Norge AS on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. No information has been released on the number of people affected or the precise volume of data involved. The incident reflects a pattern in which ransomware operators target telecommunications providers that maintain extensive customer records and network infrastructure. Public reporting on the event remains limited to the group’s claim.

Breaking down the breach

The only confirmed detail is the date the listing appeared: January 21, 2026. The group claims internal files were taken, but no further technical description, timeline of access, or confirmation of encryption has been made public. The number of records or files involved is not stated. Telia Norge AS has not issued a separate statement confirming or disputing the listing.

Who is payoutsking?

Payoutsking is a ransomware operation that maintains a leak site to publish data it claims to have stolen from victims. Like other groups in this category, it typically combines file encryption with data exfiltration and then pressures targets by threatening to release the material. The group’s listings are presented as claims until independently verified by the affected organisation or by law-enforcement reporting.

Who is Telia Norge AS?

Telia Norge AS is a Norwegian telecommunications company and a subsidiary of the Swedish Telia Company group. It supplies mobile and fixed-line telephony, broadband internet, and television services to both residential and business customers. The firm operates network infrastructure that supports voice, data transmission, and digital services throughout Norway and competes with other national providers.

What was likely exposed

The listing refers only to “internal files.” No inventory of specific data categories has been published. Telecommunications companies routinely hold customer account details, service records, and network configuration information, yet the exact contents of the exfiltrated material remain unconfirmed.

Why it matters

Telecommunications providers store data that can be used for account takeover, social-engineering attacks, or further targeting of connected services. When internal files are exposed, the organisation may face operational disruption and regulatory scrutiny under data-protection rules. Individuals whose information appears in such files can encounter increased risk of fraud or unwanted contact, even when the full scope of exposure is still unknown.

If your data was in this claimed breach

Monitor accounts linked to any Telia Norge AS services for unusual activity. Enable or strengthen multi-factor authentication on those accounts and on any connected email addresses. Review recent statements or breach notifications issued by the company for further guidance.

• Change passwords for Telia-related services and any reused elsewhere.
• Watch bank and payment accounts for unauthorised transactions.
• Run a free exposure scan of your email address against known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.