everest
First seen September 9, 2021Active396 claimed victims
The claims below are reproduced as posted by everest on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everest ransom group leaks the victim's data to the darknet and they announced that any victim that will not contact them will suffer from a data leak and they will not delete hist files for future usage.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Notin | December 23, 2025 | ransomware_live | — |
| ELC Electroconsult SpA | December 16, 2025 | ransomware_live | — |
| Sarmap - Database leaked | December 8, 2025 | ransomware_live | — |
| Benchmark Electronics Inc | December 6, 2025 | ransomware_live | — |
| Exegy | December 2, 2025 | ransomware_live | — |
| ASUS | December 2, 2025 | ransomware_live | — |
| Petra | December 2, 2025 | ransomware_live | — |
| Sarmap | December 2, 2025 | ransomware_live | — |
| Iberia | November 25, 2025 | ransomware_live | — |
| Iberia Airlines | November 25, 2025 | ransomware_live | — |
| National Money Mart Company | November 25, 2025 | ransomware_live | — |
| Air Miles España, S.A | November 24, 2025 | ransomware_live | — |
| UNDER ARMOUR | November 17, 2025 | ransomware_live | — |
| Petrobras / SAExploration | November 17, 2025 | ransomware_live | — |
| Petrobras Campos Basin 3D & 4D Seismic Survey Data | November 17, 2025 | ransomware_live | — |
| FullBeauty Brands | November 13, 2025 | ransomware_live | — |
| KorPath | November 12, 2025 | ransomware_live | — |
| Vikor Scientific, LLC / Korgene | November 12, 2025 | ransomware_live | — |
| AGFA | November 10, 2025 | ransomware_live | — |
| SIAD | November 10, 2025 | ransomware_live | — |
| Everest Exclusive Interview for Dailydarkweb.net | November 6, 2025 | ransomware_live | — |
| AT&T Careers - Database Leaked | October 28, 2025 | ransomware_live | — |
| ANIA KRUK | October 27, 2025 | ransomware_live | — |
| MotorsportMarkt.de | October 27, 2025 | ransomware_live | — |
| Dublin Airport | October 26, 2025 | ransomware_live | — |
| Svenska Kraftnät | October 25, 2025 | ransomware_live | — |
| Air Arabia | October 25, 2025 | ransomware_live | — |
| Air Arabia DataBase on sale for $2 Million | October 25, 2025 | ransomware_live | — |
| AT&T Careers | October 21, 2025 | ransomware_live | — |
| Collins Aerospace Admits Responsibility for Flight Chaos at Heathrow, Brussels and Other M... | October 19, 2025 | ransomware_live | — |
| MUSE-INSECURE: Inside Colins Aerospaces Security Failure | October 17, 2025 | ransomware_live | — |
| Colins Aerospace / RTX.com | October 17, 2025 | ransomware_live | — |
| MUSE-INSECURE: Inside Collins Aerospaces Security Failure | October 17, 2025 | ransomware_live | — |
| Collins Aerospace / RTX.com | October 17, 2025 | ransomware_live | — |
| Streebo | October 10, 2025 | ransomware_live | — |
| Professional Trust Company | September 15, 2025 | ransomware_live | — |
| Studio Legale Tisot Iuris | September 15, 2025 | ransomware_live | — |
| Key 4 Energy Srl | September 15, 2025 | ransomware_live | — |
| MFO ITALIA | September 15, 2025 | ransomware_live | — |
| BMW | September 14, 2025 | ransomware_live | — |
| Groupe Clarins | September 11, 2025 | ransomware_live | — |
| Allegis Group | September 8, 2025 | ransomware_live | — |
| Cordeiro Guerra & Associati | August 31, 2025 | ransomware_live | — |
| Everest file server now online | August 29, 2025 | ransomware_live | — |
| Easy Credit | August 29, 2025 | ransomware_live | — |
| Aupaircare and Intraxinc | August 29, 2025 | ransomware_live | — |
| Everest file server | August 29, 2025 | ransomware_live | — |
| Matiss | August 17, 2025 | ransomware_live | — |
| MYVISAJOBS.COM | August 14, 2025 | ransomware_live | — |
| BRIJU.PL | August 14, 2025 | ransomware_live | — |
| Voltus GmbH | August 12, 2025 | ransomware_live | — |
| Philadelphia Investment Partners | August 11, 2025 | ransomware_live | — |
| La Perouse | August 8, 2025 | ransomware_live | — |
| EMMCORP.COM | August 6, 2025 | ransomware_live | — |
| Brunton-Shaw | August 6, 2025 | ransomware_live | — |
| BRUNTON-SHAW.COM | August 6, 2025 | ransomware_live | — |
| DAT AUTOHUS AG | August 6, 2025 | ransomware_live | — |
| Viking Automation | July 28, 2025 | ransomware_live | — |
| Bitbox | July 26, 2025 | ransomware_live | — |
| Mailchimp | July 26, 2025 | ransomware_live | — |
| Grayscale Investments | July 26, 2025 | ransomware_live | — |
| iPROMOTEu | July 25, 2025 | ransomware_live | — |
| New American Funding - Full leak published | July 24, 2025 | ransomware_live | — |
| Best Price Financial Services | July 23, 2025 | ransomware_live | — |
| Crumbl | July 23, 2025 | ransomware_live | — |
| Crumbl - Full leak published | July 23, 2025 | ransomware_live | — |
| Watchfinder & Co | July 21, 2025 | ransomware_live | — |
| Vantage Finance | July 21, 2025 | ransomware_live | — |
| APL | July 21, 2025 | ransomware_live | — |
| New American Funding | July 15, 2025 | ransomware_live | — |
| Fishman, Larsen & Callister - Full leak published | July 11, 2025 | ransomware_live | — |
| Katz & Doorakian Law Firm, P.L. - File tree upload | July 11, 2025 | ransomware_live | — |
| Rezayat Group | July 8, 2025 | ransomware_live | — |
| Pacific HealthWorks | July 8, 2025 | ransomware_live | — |
| Avantic Medical Lab - Full leak published | July 3, 2025 | ransomware_live | — |
| Arlington Occupational Health and Wellness - Full leak published | July 3, 2025 | ransomware_live | — |
| Arlington Occupational Health and Wellness | June 17, 2025 | ransomware_live | — |
| PeopleCheck | June 13, 2025 | ransomware_live | — |
| Katz & Doorakian Law Firm, P.L. | June 12, 2025 | ransomware_live | — |
| Gallon, Takacs & Boissoneault | June 12, 2025 | ransomware_live | — |
| Department of Culture and Tourism Abu Dhabi - Full leak published | June 10, 2025 | ransomware_live | — |
| Fishman, Larsen & Callister | June 10, 2025 | ransomware_live | — |
| Avantic Medical Lab | June 10, 2025 | ransomware_live | — |
| Department of Culture and Tourism Abu Dhabi - Download link | June 10, 2025 | ransomware_live | — |
| Jordan Kuwait Bank - Full leak published | June 4, 2025 | ransomware_live | — |
| Bowles Womack & Company, P.C | May 30, 2025 | ransomware_live | — |
| Department of Culture and Tourism Abu Dhabi | May 26, 2025 | ransomware_live | — |
| Mediclinic Group | May 26, 2025 | ransomware_live | — |
| Coca-Cola | May 22, 2025 | ransomware_live | — |
| PDI Health | May 14, 2025 | ransomware_live | — |
| Kaefer | May 8, 2025 | ransomware_live | — |
| Khidmah | May 8, 2025 | ransomware_live | — |
| Balance Diagnostics | May 6, 2025 | ransomware_live | — |
| Jamjoom Pharma | May 1, 2025 | ransomware_live | — |
| Jordan Kuwait Bank | April 26, 2025 | ransomware_live | — |
| ITSS | February 4, 2025 | ransomware_live | — |
| C2S Technologies Inc. | February 4, 2025 | ransomware_live | — |
| Weeks, Brucker & Coleman, Ltd | Legal Services | January 27, 2025 | ransomware_live | — |
| Solaris-pharma.com | January 21, 2025 | ransomware_live | — |
| The Hoff Brand SL | January 16, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).