SODIC listed by the Payload ransomware group

Overview

The Payload ransomware group has listed SODIC, a leading Egyptian real estate development company, on its leak site. The company has operated for over 28 years in West Cairo, East Cairo and the North Coast. The listing appeared on 17 February 2026.

What was published

The group claims to have exfiltrated corporate data from the developer. The archive is expected to include client records, project documentation, financial documents and employee files.

Risks for affected individuals

• Property buyers' personal and financial data may be exposed.
• Project documentation could be of commercial value.
• Employee records may be included.

What remains unknown

• The volume of data exfiltrated.
• Whether the data has been published.
• The negotiation status.

What affected people should do

Clients should monitor communications and verify any unusual requests. SODIC should notify clients and staff, secure its systems, and communicate the scope of the incident.