Soprolux: banking documents and customer data released after a cyberattack

On 8 May 2026, Soprolux — a French distributor of food and specialty products serving restaurants and professional clients, primarily in eastern France — was named as a victim by the BravoX ransomware group, which claimed to have breached the company and published internal documents and databases to back its claims.

BravoX operated a classic double-extortion scheme, combining the encryption of the victim's systems with the threat to publish stolen data unless a ransom was negotiated. To substantiate the claim, the group leaked samples of internal files, including commercial spreadsheets and management data covering Soprolux's network of restaurant partners, suppliers and commercial contacts.

The exposed data reportedly included:

• Professional client and prospect lists
• Company contact details and executive/management information
• Email addresses and phone numbers
• Tax records and VAT numbers
• SEPA direct-debit mandates
• Bank account details (RIB/IBAN)
• Internal commercial spreadsheets and management data

The leaked banking details and SEPA mandates create a significant fraud risk: affected businesses were urged to stay alert to identity theft, phishing, and fraudulent IBAN-change or payment requests. As of disclosure, no public response or confirmation from Soprolux had been reported, and the overall scale of the breach (number of records or clients) was not disclosed.