Leak-site post naming Conway Analytics, captured by ThreatCluster

Conway Analytics

everest

Ransomware leak-site victim intelligence

Data size
40 TB
Files
78,077
Views
35,000
Posted
Aug 5, 2026
Countdown
The files will be published after the timer counts down. The company still has time to get in touch with us
Country
US
Industry
Technology

Summary

Written by ThreatCluster from site fields, file listing, victim profile, leak post, screenshot

Everest group claims to have exfiltrated about 40 TB of data from Conway Analytics, comprising roughly 78,077 file and path entries. The data categories claimed include database backups, cloud billing records, AWS deployment packages, research environments, AI/ML models, article-processing data, advisory and consulting project archives, legacy corporate archives, Site Selection Magazine backups, production materials and event archives. The leak page names conwayanalytics.com and shows a publication status of published with a countdown before release, indicating the company still has time to contact the group.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
CommonSpot AWS Chalice Git DynamoDB PyTorch Python JavaScript CSS HTML SQLite

What was taken

The dataset represents the corporate technology, database, operational, advisory and archival data environment of conwayanalytics.com and associated Conway Analytics, Conway Advisory, ICA Legacy and Site Selection Magazine operations. The available dataset contains approximately 78,077 file/path entries across the two provided parts. Around 75,685 entries are outside clearly encrypted backup structures, while approximately 2,392 entries belong to encrypted or obfuscated backup directories that require appropriate access credentials or decryption. The available dataset is organized around Conway Analytics’ database backups, cloud billing records, AWS deployment packages, research application environments, AI / machine-learning models, article-processing data, advisory and consulting project archives, legacy corporate archives, Site Selection Magazine backups, production materials, event archives and internal migration materials. The dataset includes SQL and application database backups, including ConwayAnalytics, CommonSpot site backups, CommonSpot user backups, client-variable databases, production-related database exports and large volumes of database log files. A major portion of the data relates to historical and operational application databases. The dataset contains production, QA and development environments for conwayanalytics.com, research.conwayanalytics.com, research-qa.conwayanalytics.com and research-dev.conwayanalytics.com, including application pages, account pages, reset-password pages, admin pages, static assets, JavaScript, CSS, templates, vendor libraries, sync scripts, Git metadata and web application resources. The cloud and infrastructure layer includes AWS billing CSV files, detailed billing line-item exports, cost-allocation files and resource/tag billing exports covering the period from 2017 to 2026. These files contain cloud usage, service costs, resource allocation, billing history and infrastructure cost-tracking information. The deployment layer includes AWS Lambda packages, Chalice deployments, serverless deployment files and production, QA or development packages for article extraction, classifiers, NLP processing and automated research workflows. The dataset also contains Python runtime backup packages, deployment templates, API fixes, backend service packages and multiple production, QA and development deployment archives. The AI and machine-learning layer includes NER models, binary and multi-label classifiers, lead-type models, project-type models, sector models, joblib and pickle model files, PyTorch model fragments, model manifests and training/sample datasets. These materials are connected to article classification, lead detection, project classification, sector tagging, NLP processing and automated research workflows. The research-content layer includes article archives, NLP text outputs, public sample articles, production research article datasets, compressed article exports, NAICS-related assets and DynamoDB export data. These files contain processed article content, extracted research materials, NLP outputs and data used by the Conway Analytics research pipeline. The advisory and project-delivery data covers a wide range of clients, institutions and regional engagements, including investment promotion, economic development, free-zone advisory, location selection, foreign direct investment, sector analysis, marketing strategy, lead generation, customer journey mapping, business attraction and public-private advisory work. The data includes projects and proposal materials connected to North America, Europe, Asia, Latin America, the Middle East and Africa. The dataset includes client and project materials for entities and engagements such as Jordan Implementation, Coast Packing Company, Sturgeon County FDI, Fort Saskatchewan, Thor Industries, Waterloo Townships, Helsinki Business Hub, CRRC / NAI Hunneman, Qatar Financial Centre Authority, Qatar Freezone Authority, Colombian Free

Data categories
database backupscloud billing recordsAWS deployment packagesresearch application environmentsAI / machine-learning modelsarticle-processing dataadvisory and consulting project archiveslegacy corporate archivesSite Selection Magazine backupsproduction materialsevent archivesinternal migration materialsCommonSpot site backupsCommonSpot user backupsclient-variable databasesproduction-related database exportsdatabase log filesapplication pagesreset-password pagesadmin pagesstatic assets

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

download_link
https://gofile.io/d/mp1U1h

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page 11 KB
Logo of Keysight Technologies featuring a red waveform graphic and the company name in white text.
onion leak page 128 KB
onion leak page 11 KB
Logo featuring the text "mansfield" in a stylized font, with "FAMILY DENTISTRY" below it.
onion leak page 1.4 KB
Logo featuring a stylized letter "P" in orange with a black play button icon integrated into the design.
onion leak page 7.5 KB
onion leak page 5.8 KB
Logo featuring the text "Al-Futtaim" in blue, with "automotive" in a smaller font below it, accompanied by a geometric symbol.
onion leak page 5.6 KB
The image features a logo with stylized figures in orange and blue, representing people, alongside the text "ALZONE" in blue.
onion leak page 7.0 KB
Logo of Emirates Flight Catering, featuring stylized text in gold and red.
onion leak page 6.8 KB
Logo of Dharma Group featuring a stylized design with blue and green colors, accompanied by the text "DHARMA GROUP" below it.
onion leak page 7.7 KB