Thompson+Hanson Listed by payoutsking Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 14, 2025, the landscape architecture firm Thompson+Hanson was listed by the ransomware group known as payoutsking. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed.

The listing itself constitutes a claim by the group rather than independent confirmation of the full scope or impact. For a firm that holds client project records, employee information, and operational data, any unauthorized access to internal files raises concrete questions about potential exposure of personal and business information.

What happened

According to available reports, Thompson+Hanson was named on a payoutsking leak site on July 14, 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No public information has been released regarding the precise date of the intrusion, the initial access method, the volume of data taken, or whether systems were encrypted. The number of individuals whose information may have been involved is listed as unknown. Public detail is limited to the fact of the listing and the assertion that internal files were removed from the company’s environment.

Ransomware incidents of this type typically involve both data theft and a demand for payment to prevent publication, but no ransom amount, negotiation status, or confirmation of data release has been reported in connection with this specific case. Until additional verified information appears, the scale and technical details of the event remain undisclosed.

Inside payoutsking

payoutsking is a ransomware operation that, like other groups of its kind, maintains a public leak site on which it names organizations it claims to have compromised. Such groups commonly gain access through phishing, exploited vulnerabilities, or stolen credentials, then exfiltrate data before deploying encryption. Their standard practice is to threaten publication of stolen material unless a ransom is paid. Prior public activity associated with the name has followed this double-extortion pattern, though each listing must be treated as an unverified claim by the actors themselves.

In the present instance, the group’s listing of Thompson+Hanson asserts that internal files were taken. No independent forensic confirmation of that claim has been made public, and no additional statements attributed specifically to this victim beyond the listing itself have been reported. The group’s tactics are well-documented across multiple incidents, yet the precise tools, timelines, or communications used against Thompson+Hanson remain undisclosed.

Who is Thompson+Hanson?

Thompson+Hanson is a landscape architecture firm established in 1985 in Texas. It specializes in personalized garden designs that combine architectural planning with horticulture to create outdoor spaces. The company also operates garden shops and a café, offering plants, garden essentials, and related items. Organizations of this type typically maintain client project files, design drawings, contact details, employee records, supplier contracts, and financial or operational documents necessary to run both design services and retail operations.

A breach involving internal files at such a firm is consequential because the data can include personally identifiable information of clients and staff, proprietary design work, and business records. Even when the exact contents remain unconfirmed, the nature of the work means that exposure could affect individuals who engaged the firm for residential or commercial projects as well as current and former employees.

What data was at risk

The only data type named in connection with the incident is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the files contained client names, addresses, payment details, employee records, or design documents—has been disclosed. Exact contents are therefore unconfirmed.

Landscape architecture and garden-retail businesses ordinarily hold client contact and project information, employee personnel files, vendor agreements, and internal operational records. In the absence of a verified inventory, it is not possible to state which of these categories, if any, were among the files claimed by payoutsking. Public reporting does not identify specific documents, file counts, or data fields.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details for phishing or social-engineering attempts, and, if financial or identity-related data were present, elevated chances of fraud. Because the precise data types remain unconfirmed, the severity for any given person cannot yet be assessed. Clients who commissioned designs or made purchases through the firm’s shops and café, as well as employees, are the populations most likely to be concerned.

For the organization itself, the incident carries operational and reputational consequences. Recovery from ransomware often requires system restoration, forensic review, and notification processes. Even without confirmed encryption or public data dumps, the mere claim of exfiltration can prompt clients and partners to seek assurances about the security of their information. No dollar figures, downtime estimates, or confirmed secondary impacts have been reported.

Were you affected?

If you have been a client, employee, or supplier of Thompson+Hanson, treat the possibility of exposure seriously while recognizing that the number of people affected and the exact data involved remain unknown. Practical first steps include the following:

• Monitor financial accounts and credit reports for unexpected activity.
• Be alert to unsolicited emails or calls that reference the firm or recent projects; verify any such contact through known official channels.
• Change passwords for any accounts that may have shared credentials or reused passwords with systems related to the firm.
• Consider placing a fraud alert with major credit bureaus if you believe sensitive personal data could have been involved.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public dumps unrelated or related to this incident.

Official notifications, if required, would come directly from the company or relevant authorities. Until more verified detail is released, remain cautious with personal information and rely only on confirmed sources for updates.

AICompiled with AI assistance from public sources and published under our editorial standards.