Sonae
ransomexxThis record tracks a ransomware attack claimed by the ransomexx group against Sonae. It collects the publicly disclosed attack details — sector, location and timeline — as published on the operator's leak site and indexed by Breach House.
Window Zero
EXPOSURE GAPWindow Zero is the time the breach stayed in the open before anyone said so — the gap between when the attack was first discovered on the operator's leak site (t1) and when it was publicly disclosed (t2). The wider this window, the longer victims, staff and customers were exposed with no warning.
Attack Summary
Sonae is a Portugal-based multinational conglomerate founded in 1959, headquartered in Maia, Porto, and operating as a public company in the investment management sector. The group manages a diversified portfolio spanning retail, financial services, technology, shopping centers, and telecommunications, with Sonae MC serving as a leading food retailer in Iberia. Sonae SGPS, S.A. functions as an active investment company with market-leading retail and service operations across multiple sectors. Sonae was listed as a ransomware victim associated with the threat actor ransomexx.
Leak Screenshots
SAMPLEProof-of-breach screenshots the operator posted from the stolen data. Previews are redacted and locked — the originals are available on HaveIBeenRansom.