About
Written by ThreatCluster from 27 storiesEverest is a ransomware group that operates an extortion-focused model, breaching networks to exfiltrate data and threatening to publish it on the dark web unless a ransom is paid. Victims span healthcare, technology, business services, financial services, and manufacturing, with the United States, Italy, the United Arab Emirates, Spain, and Germany most affected. Recent reporting shows a pattern of large-scale data exfiltration followed by ransom demands or threats to leak the data, illustrated by Everest’s breach of Stadler Rail and a CHF 10 million ransom demand after attackers accessed a supplier data-exchange platform. Across the reported incidents, Everest has claimed breaches affecting multiple sectors and regions, with about 240 victims claimed.
Sectors: Healthcare, Technology, Manufacturing · Countries: US, IT, AE
Recent victims
View all →| Victim | Sector | Country | Data | Files | Views | Posted | Status |
|---|---|---|---|---|---|---|---|
| Kissei Shoji kissei-shoji.co.jp | Manufacturing | JP | 323 GB | 278,326 | 4,400 | Oct 17, 2026 | listed |
| Chugoku Bend bend.co.jp | Manufacturing | 90.53 GB | 4,050 | 4,600 | Oct 17, 2026 | listed | |
| Taekwang Network | Network integration | South Korea | 263.71 GB | 54,581 | 4,200 | Oct 17, 2026 | listed |
| Brenner Base Tunnel bbt-se.com | Transportation | AT | 812 GB DataBase | — | 1,700 | Oct 17, 2026 | published |
| KVH | Technology | US | — | — | — | Oct 13, 2026 | |
| Laerdal laerdal.com | Healthcare | NO | 17.13 GB | 71,136 | 8,500 | Oct 12, 2026 | listed |
| Topcon Healthcare topconhealthcare.eu | ophthalmic product environment | JP | 245.59 GB | 17,170 | 8,400 | Oct 13, 2026 | listed |
| Agri Industrial agri-industrial.com | a supplier of agricultural and industrial components | 19.86 GB | 179,585 | 15,000 | Oct 11, 2026 | listed | |
| B-accountants b-accountants.be | Accounting | Belgium | 643 GB | 1,102,182 | 15,000 | Oct 18, 2026 | listed |
| Morcon Developments morcon.com.au | Other | 10.41 GB | 21,592 | 15,000 | Oct 6, 2026 | listed | |
| Kennametal | Manufacturing | US | — | — | — | Oct 6, 2026 | |
| Flydubai flydubai.com | Transportation | AE | 4.36 GB | 16,517 | 16,000 | Oct 6, 2026 | listed |
| Securitas Group securitas.com | Electronic security | SE | 92.04 GB | 175 | 22,000 | Sep 25, 2026 | listed |
| Morula IVF morulaivf.co.id | Fertility care / assisted reproduction | Indonesia | 98.21 GB | 110,997 | 20,000 | Sep 25, 2026 | listed |
| Reliance Audit relianceaudit.com.sg | Professional Services | 551.66 GB | 591,191 | 23,000 | Sep 25, 2026 | listed | |
| UNIRITA unirita.co.jp | Software and IT-services | Japan | 127.964 GB | 159,901 | 20,000 | Sep 25, 2026 | listed |
| CENELEC cencenelec.eu | electrotechnical standardization | BE | 159.22 GB | 190,790 | 22,000 | Sep 25, 2026 | listed |
| ETS ets.org | Education | 139.85 GB | 93,461 | 476 | Sep 25, 2026 | countdown | |
| GGS ggsinc.com | Not Found | 66.45 GB | 14,672 | 32,000 | Sep 7, 2026 | listed | |
| KÖRBER koerber.com | warehouse and supply-chain management software | DE | 1 TB | 1,701,008 | 31,000 | Sep 7, 2026 | listed |
| GENESILICO genesilico.ai | precision-oncology and genomics | IT | 148 GB | 71 | 32,000 | Sep 7, 2026 | listed |
| Rise UP riseup.ai | SaaS learning-platform operations | 473.08 GB | 82,897 | 36,000 | Sep 1, 2026 | listed | |
| VIVOTEK vivotek.com | Technology | TW | 236.29 GB | 94,837 | 50,000 | Sep 8, 2026 | listed |
| Italtel Peru italtel.com | The repository reflects the work of a systems integrator delivering enterprise networking, wireless connectivity, data-c | PE | 388.996 GB | 2,778,353 | 37,000 | Sep 1, 2026 | listed |
| CCA Bank cca-bank.com | Banking | 18.92 GB | 11,837 | 44,000 | Aug 20, 2026 | listed |
Found by ThreatCluster
235 total from our crawlListed on this group's leak site and not present in the aggregated feeds.