Ransomware Group intelligence
Everest
ActiveTrack Everest with 434 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Everest is tracked by Breach House as a ransomware group with 434 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
97
- Leaked 81 83.5%
- Pending 14 14.4%
- Deleted 2 2.1%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion |
| Leak location 2 | Onion service | Up checked 1h ago | everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion |
Top Activity Sectors (16)
- Not identified 108
- Finance / Legal / Insurance 51
- Healthcare / Pharma 46
- Communication / Marketing 43
- Services 37
- IT 27
- Manufacturing / Engineering 16
- Transportation / Travel / Logistics 15
- Energy 14
- Construction / Real Estate 10
- Retail / E-commerce 7
- Public Sector 7
- Agriculture / Food 6
- Hospitality / Food & Beverage / Tourism 6
- Telecommunications 5
- Education 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Everest, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: everest uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: everest modifies Windows Registry Run Keys to ensure ransomware execution persists across reboots on compromised hosts.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: everest disables or modifies security tools like antivirus software to evade detection during initial compromise and execution phases.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: everest deletes Volume Shadow Copies and backup directories via system commands to prevent data recovery without payment.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: everest accesses LSASS memory using credential-stealing tools to harvest user credentials for lateral access and evasion.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: everest performs network share discovery to identify accessible remote directories for lateral movement and victim data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: everest exploits SMB/Windows Admin Shares for lateral movement between networked systems within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: everest encrypts victim files using custom ransomware binaries to maximize impact and force ransom payments.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: everest executes Service Stop commands to terminate critical services, disrupting operational continuity during ransomware deployment.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: everest invokes system recovery inhibition commands to prevent backup restoration and isolate compromised machines.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Tools Observed (8)
▼Software Everest has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
ProcDump
Discovery & enumeration
SoftPerfect NetScan
Offensive security tooling
Cobalt Strike
Metasploit
Meterpreter
Remote monitoring & management
AnyDesk
Atera
Splashtop
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
EVERESTRANSOMWARE.txt
Dear [snip], Greetings from the Everest team. Your systems have been attacked, the files are encrypted. You can read about us in our blog (Tor browser needed) Blog : ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion Or read about our group in Twitter Also, our team was able to bypass your "Dataprotection" as any other your protection software and more than 1 Terabyte of internal files were exfiltrated to our servers, which we can confirm with great joy and ease The list contains financial documents, internal orders, KYC information(documents,photos...), trusted representatives personal info Client risk levels,loans, debt and client data. Various financial documentation, backups , etc. etc. The information was collected both from personal PCs and from centralized storage locations. If an agreement is reached with us, this information will never be published and the problem will disappear as if it never happened, otherwise it will be posted on our blog and darknet. Which will lead to even greater financial and reputational losses on your part. Also you will get 1.Attack logbook (months of experience with your company) with full list of vulnerabilities and bypass methods 2.Advices how to singifically improve your security and avoid such attacks in the future 3.We will delete all files from your company 4.We will attack your company no more Yours trully Everest Team Email to contact: [email protected] Your key: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (434)
Search, filter and paginate the victim timeline for Everest. Showing 1–100 of 434.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | GGS id32639 View details | Philippines | Services | — | ||
|
GGS operates within the Services sector and is associated with the Philippine jurisdiction. Its role within the threat-intelligence index is documented specifically as a ransomware victim connected to the everest threat actor. This listing type captures the entity's exposure profile within cybersecurity intelligence databases, providing context on its operational environment and adversary linkage without disclosing unverified incident details. The entry serves to inform defenders and analysts regarding potential attack surfaces and associated threat activity for monitoring and risk assessment purposes. |
||||||
| Ransomware | GGS id32639 View details | Philippines | Services | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | KÖRBER id32640 View details | Germany | Manufacturing / Engineering | pending | ||
|
KÖRBER is cataloged as a ransomware victim operating within the manufacturing and engineering sectors, with operational context linked to Germany. The entity represents a business organization impacted by ransomware activity, reflecting vulnerabilities within industrial and engineering workflows where operational continuity and data integrity are critical concerns. Threat intelligence records associate KÖRBER with the threat actor everest, providing context for incident linkage and behavioral analysis within the broader cyber threat landscape. This listing type documents the entity’s status as a ransomware victim without disclosing unverified incident details, preserving factual neutrality for catalog and analytical use. KÖRBER was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | KÖRBER id32640 View details | Germany | Manufacturing / Engineering | pending | ||
|
[AI generated] Körber is a German technology conglomerate headquartered in Hamburg, Germany. The company operates across multiple industries including supply chain automation, pharma, tissue, tobacco, and digital solutions. Körber develops and delivers software, machinery, and integrated systems to help businesses optimize their operations. With a global presence spanning numerous countries, it serves clients in logistics, healthcare, and manufacturing sectors worldwide. |
||||||
| Ransomware | GENESILICO id32641 View details | Italy | Healthcare / Pharma | pending | ||
|
GENESILICO operates within the Healthcare and Medicine sector, with operational context tied to the IT domain. The entity represents a healthcare organization whose infrastructure was impacted as part of an incident cataloged under ransomware activity. This listing type identifies GENESILICO as a ransomware victim associated with the threat actor everest. The description focuses on the entity's sector, geographic/operational context, and its classification within the threat-intelligence index without disclosing unverified incident specifics. All details presented adhere to neutral, authoritative reporting standards for cybersecurity intelligence. |
||||||
| Ransomware | GENESILICO id32641 View details | Italy | Healthcare / Pharma | pending | ||
|
[AI generated] GeneSilico is a Polish bioinformatics company based in Warsaw, operating within the life sciences and computational biology sector. It specializes in RNA and protein structure prediction, molecular modeling, and bioinformatics software development. The company provides research services and tools to academic and pharmaceutical clients, supporting drug discovery and genomic research. It is affiliated with the Institute of Biochemistry and Biophysics of the Polish Academy of Sciences. |
||||||
| Ransomware | Negotiation Rules id32580 View details | — | pending | |||
|
Negotiation Rules describes a ransomware victim entity within a threat-intelligence index, associated with the threat actor everest. This listing type identifies organizations or individuals that engaged with negotiation protocols following ransomware activity, providing structured context for sector-specific analysis and intelligence benchmarking. The entry reflects operational frameworks relevant to cybersecurity response, incident communication, and threat actor behavioral patterns without disclosing confirmed breach details or invented specifics. It serves as a neutral catalog reference for analysts evaluating everest activity across affected environments and victim response contexts. |
||||||
| Ransomware | Negotiation Rules id32580 View details | — | pending | |||
|
[AI generated] N/A |
||||||
| Ransomware | Rise UP id32371 View details | United States | Services | leaked | ||
|
Rise UP is a company operating within the Services sector located in the United States. As cataloged in threat-intelligence indexing, Rise UP is classified as a ransomware victim linked to the threat actor everest. The listing type identifies its relationship within the ransomware incident landscape without disclosing unverified technical details, breach scope, or operational impact. This description provides neutral, authoritative context for catalog users assessing entity risk, sector exposure, geographic origin, and associated threat actor provenance. Rise UP was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Rise UP id32371 View details | United States | Services | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | VIVOTEK id32372 View details | Taiwan, Province of China | IT | leaked | ||
|
VIVOTEK is an entity operating within the IT sector, based in Taiwan (country: TW). The organization provides technology-focused services and solutions relevant to enterprise information systems, data infrastructure, and digital operations within its sector. It has been formally cataloged as a ransomware victim associated with the threat actor everest. This listing reflects its inclusion in the threat-intelligence index based on its verified association with everest and its classification within the IT sector of Taiwan. The description remains neutral and avoids speculation regarding breach details, data impact, or operational specifics. |
||||||
| Ransomware | VIVOTEK id32372 View details | Taiwan, Province of China | IT | leaked | ||
|
[AI generated] VIVOTEK is a Taiwanese company founded in 2000 and headquartered in New Taipei City, Taiwan. It specializes in network surveillance products, including IP cameras, video management software, and network video recorders. Operating in the physical security and surveillance industry, VIVOTEK serves global markets across retail, transportation, education, and government sectors, and is recognized as one of Asia's leading providers of IP surveillance solutions. |
||||||
| Ransomware | Italtel Peru id32373 View details | Peru | Telecommunications | leaked | ||
|
Italtel Peru is a telecommunications enterprise operating in Peru, providing connectivity and communications-related services within the PE sector. The entity is cataloged in this threat-intelligence index under the listing type ransomware victim, linked to the associated threat actor or source everest. The description focuses on the entity's identity, operational sector, geographic presence, and the verified association with the everest threat actor without disclosing unconfirmed incident details. This entry supports threat-intelligence analysis for telecommunications infrastructure and regional cyber-risk monitoring. |
||||||
| Ransomware | Italtel Peru id32373 View details | Peru | Telecommunications | leaked | ||
|
[AI generated] Italtel Peru is a subsidiary of Italtel, an Italian telecommunications technology company. Operating in Peru, it provides ICT solutions including network infrastructure, system integration, and telecommunications services. The company serves enterprise and public sector clients, offering digital transformation, unified communications, and managed services. It operates within the telecommunications and information technology industry in the Peruvian market. |
||||||
| Ransomware | CCA Bank id31853 View details | — | leaked | |||
|
[AI generated] N/A |
||||||
| Ransomware | Kingston Technology id31868 View details | United States | — | — | ||
|
[AI generated] Kingston Technology is a privately held American company founded in 1987 and headquartered in Fountain Valley, California. It is one of the world's largest manufacturers of memory products, including DRAM modules, flash storage, USB drives, and solid-state drives. Kingston serves consumer, enterprise, and embedded markets globally, supplying components to major OEMs and retail customers across the technology industry. |
||||||
| Ransomware | Experts Entreprendre id31869 View details | France | — | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Grupo DT id31870 View details | Spain | — | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Capgemini Engineering id31871 View details | France | — | leaked | ||
|
[AI generated] Capgemini Engineering is a global technology and engineering services company headquartered in France. It provides R&D and engineering outsourcing services across industries including aerospace, automotive, telecommunications, energy, and semiconductors. Operating in over 30 countries, it combines software, hardware, and connected systems expertise to help clients design, develop, and deploy innovative products and digital solutions. |
||||||
| Ransomware | Rx Networks id31791 View details | Canada | — | — | ||
|
[AI generated] Rx Networks is a Canadian technology company headquartered in Vancouver, British Columbia. It specializes in positioning and location technologies, providing GPS and GNSS assistance data solutions. The company serves the mobile and connected devices industry, offering services that improve location acquisition speed and accuracy. Its clients include device manufacturers, chipset vendors, and mobile network operators worldwide. |
||||||
| Ransomware | Ingersoll Rand id31479 View details | United States | Manufacturing / Engineering | leaked | ||
|
Ingersoll Rand is a US-based company operating in the manufacturing and engineering sector, providing a range of products and services. The company offers various solutions for industries such as construction, mining, and oil and gas. Ingersoll Rand was listed as a ransomware victim associated with everest |
||||||
| Ransomware | Ingersoll Rand id31479 View details | United States | Manufacturing / Engineering | leaked | ||
|
[AI generated] Ingersoll Rand is an American industrial manufacturing company headquartered in Davidson, North Carolina. It designs and produces a wide range of industrial equipment including air compressors, power tools, fluid management systems, and HVAC solutions. The company serves diverse sectors such as manufacturing, construction, and energy. Formerly part of a larger conglomerate, it operates globally across multiple countries and markets. |
||||||
| Ransomware | Omnicell id31480 View details | United States | Healthcare / Pharma | — | ||
|
Omnicell is a US-based company operating in the healthcare and pharmaceutical sector, providing innovative solutions and services. The company offers a range of products, including automated dispensing systems and medication management solutions. Omnicell was listed as a ransomware victim associated with everest |
||||||
| Ransomware | Omnicell id31480 View details | United States | Healthcare / Pharma | — | ||
|
[AI generated] Omnicell is a United States-based healthcare technology company founded in 1992 and headquartered in Austin, Texas. It specializes in medication management solutions, providing automated pharmacy systems, dispensing cabinets, and software platforms to hospitals, pharmacies, and healthcare facilities. Its products aim to improve medication safety, reduce errors, and streamline pharmacy workflows across the healthcare industry. |
||||||
| Ransomware | EPM id31249 View details | Colombia | Energy | leaked | ||
|
EPM is a Colombian energy company that provides various services including electricity, gas, and water to its customers. The company operates primarily in Colombia and offers a range of energy solutions to its clients. EPM was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | EPM id31249 View details | Colombia | Energy | leaked | ||
|
[AI generated] EPM (Empresas Públicas de Medellín) is a Colombian public utility company headquartered in Medellín, Colombia. It operates in the energy, water, and telecommunications sectors, providing electricity generation and distribution, water supply, sewage, and natural gas services. It serves millions of customers across Colombia and has expanded operations into other Latin American countries, making it one of the largest public utility groups in the region. |
||||||
| Ransomware | AKM Enterprises INC id31251 View details | United States | Construction / Real Estate | leaked | ||
|
Akmenterprisesinc.com is a US-based company operating in the construction and real estate sector, providing various services to its clients. The company is involved in construction and real estate development projects. Akmenterprisesinc.com was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | AKM Enterprises INC id31251 View details | United States | Construction / Real Estate | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Formulatrix id31253 View details | United States | Manufacturing / Engineering | pending | ||
|
Formulatrix is a US-based company operating in the manufacturing and engineering sector, offering products and services related to laboratory automation and scientific research. The company is headquartered in the United States and provides solutions for various industries. Formulatrix was listed as a ransomware victim associated with everest |
||||||
| Ransomware | Formulatrix id31253 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Formulatrix is a US-based company headquartered in Bedford, Massachusetts, that designs and manufactures laboratory automation instruments primarily for the life sciences industry. The company specializes in liquid handling robotics, imaging systems, and automation solutions used in drug discovery, protein crystallography, and genomics research. Its products are widely adopted by pharmaceutical companies, biotechnology firms, and academic research institutions worldwide. |
||||||
| Ransomware | Oasis Legal Group id31255 View details | United States | IT | leaked | ||
|
Oasislg.com is an IT company based in the United States, providing various services within the IT sector. The company operates in a sector that involves a range of technology-related services and solutions. Oasislg.com was listed as a ransomware victim associated with Everest |
||||||
| Ransomware | Oasis Legal Group id31255 View details | United States | IT | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Conway Analytics id31256 View details | United States | IT | pending | ||
|
Conway.ai is an IT company based in the US, offering various services. The company operates in the IT sector, providing solutions to its clients. Conway.ai was listed as a ransomware victim associated with Everest. |
||||||
| Ransomware | Conway Analytics id31256 View details | United States | IT | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Greenbotz id31258 View details | India | Other | pending | ||
|
Greenbotz.co is an entity based in India, operating in the other sector. The company likely provides various services, although specific details about its offerings are not readily available. Greenbotz.co was listed as a ransomware victim associated with Everest |
||||||
| Ransomware | Greenbotz id31258 View details | India | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | NIMR Oil id31260 View details | United Arab Emirates | Other | pending | ||
|
Nimroil.com is an entity based in the United Arab Emirates, operating in the other sector. The company likely provides various services, given its sector classification. Nimroil.com was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | NIMR Oil id31260 View details | United Arab Emirates | Other | pending | ||
|
[AI generated] NIMR Oil is an Omani oil and gas company operating primarily in the Sultanate of Oman. It specializes in the production, processing, and management of crude oil and natural gas resources. The company works within Oman's energy sector, often collaborating with the national oil infrastructure. NIMR is known for operating mature oilfields and applying enhanced recovery techniques to maximize output from established reserves. |
||||||
| Ransomware | TechCorr id31262 View details | IT | pending | |||
|
Techcorr.com operates within the IT sector, providing various technology-related services. As a company in this sector, it is involved in activities related to information technology. Techcorr.com was listed as a ransomware victim associated with Everest |
||||||
| Ransomware | TechCorr id31262 View details | IT | pending | |||
|
[AI generated] N/A |
||||||
| Ransomware | Rodschinson Investment id31264 View details | Belgium | Other | leaked | ||
|
Rodschinson.com is a Belgian entity operating in the other sector, providing unspecified offerings. Located in Belgium, the company's specific activities are not well-documented. Rodschinson.com was listed as a ransomware victim associated with Everest |
||||||
| Ransomware | Rodschinson Investment id31264 View details | Belgium | Other | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Allied Telesis id31266 View details | Japan | Manufacturing / Engineering | leaked | ||
|
Allied Telesis is a Japanese company that designs, manufactures, and markets network infrastructure and telecommunications products. The company operates in the manufacturing and engineering sector, providing solutions for various industries. Allied Telesis offers a range of products, including network switches, routers, and wireless devices. It was listed as a ransomware victim associated with Everest |
||||||
| Ransomware | Allied Telesis id31266 View details | Japan | Manufacturing / Engineering | leaked | ||
|
[AI generated] Allied Telesis is a global networking solutions provider headquartered in Tokyo, Japan. Founded in 1987, the company operates in the telecommunications and IT infrastructure industry, designing and manufacturing network hardware and software including switches, routers, wireless access points, and network management systems. It serves enterprise, government, healthcare, and education sectors across more than 40 countries worldwide. |
||||||
| Ransomware | Dharma Group id31268 View details | Finance / Legal / Insurance | leaked | |||
|
Dharma Group is a company operating in the finance, legal, and insurance sector. The company provides various services to its clients. Dharma Group was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Dharma Group id31268 View details | Italy | Finance / Legal / Insurance | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Emirates Flight Catering id31270 View details | United Arab Emirates | Transportation / Travel / Logistics | leaked | ||
|
Emirates Flight Catering is a leading provider of catering and logistics services to the aviation industry, based in the United Arab Emirates. The company offers a wide range of services, including meal preparation, logistics, and supply chain management, to various airlines and airports. Emirates Flight Catering operates in the transportation and travel sector, providing essential services to support the aviation industry. It was listed as a ransomware victim associated with everest |
||||||
| Ransomware | Emirates Flight Catering id31270 View details | United Arab Emirates | Transportation / Travel / Logistics | leaked | ||
|
[AI generated] Emirates Flight Catering is a leading airline catering company headquartered in Dubai, United Arab Emirates. It operates one of the world's largest catering facilities, providing in-flight meals and hospitality services primarily to Emirates airline and other carriers at Dubai International Airport. The company serves millions of meals annually and also offers event catering and food production services across the region. |
||||||
| Ransomware | Alzone Software id31272 View details | IT | leaked | |||
|
Alzone Software is an IT sector company that provides software solutions. The company operates in the information technology sector, offering various software products and services. Alzone Software was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Alzone Software id31272 View details | IT | leaked | |||
|
[AI generated] N/A |
||||||
| Ransomware | Al-Futtaim Group id31274 View details | United Arab Emirates | Retail / E-commerce | leaked | ||
|
Al-Futtaim Group is a leading retail and e-commerce company based in the United Arab Emirates, offering a diverse range of products and services across various sectors. The company operates in multiple countries, providing a wide range of consumer and commercial products. Al-Futtaim Group was listed as a ransomware victim associated with everest |
||||||
| Ransomware | Al-Futtaim Group id31274 View details | United Arab Emirates | Retail / E-commerce | leaked | ||
|
[AI generated] Al-Futtaim Group is a diversified conglomerate headquartered in Dubai, United Arab Emirates. Founded in the 1930s, it operates across retail, automotive, real estate, and financial services sectors. The group represents major global brands including IKEA, Toyota, and Marks & Spencer across the Middle East, Africa, and Asia. It is one of the region's most prominent privately held business enterprises. |
||||||
| Ransomware | Aptara id31276 View details | India | IT | leaked | ||
|
Aptara is a technology company based in India, operating in the IT sector, providing digital transformation solutions. The company offers a range of services, including content creation, digital publishing, and technology solutions. Aptara was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Aptara id31276 View details | India | IT | leaked | ||
|
[AI generated] Aptara is a US-based digital content transformation company specializing in publishing, learning, and content solutions. Operating primarily in the publishing and e-learning industries, it provides services such as content conversion, instructional design, digital publishing, and XML/DITA authoring. Founded in 1988 and headquartered in Falls Church, Virginia, Aptara serves clients in education, government, and corporate sectors globally, helping organizations transition traditional content into digital formats. |
||||||
| Ransomware | Powerweave id31278 View details | India | IT | leaked | ||
|
Powerweave is an IT company based in India, offering various services to its clients. As an IT company, Powerweave provides a range of solutions to support businesses in the country. Powerweave was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Powerweave id31278 View details | India | IT | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Mansfield Family Dentistry id31280 View details | United States | Healthcare / Pharma | leaked | ||
|
Mansfielddentistry.com is a dental care service provider based in the United States, operating within the healthcare sector. The entity offers various dental services to its patients. Mansfielddentistry.com was listed as a ransomware victim associated with Everest. |
||||||
| Ransomware | Mansfield Family Dentistry id31280 View details | United States | Healthcare / Pharma | leaked | ||
|
[AI generated] Mansfield Family Dentistry is a dental practice operating in the United States, likely located in Mansfield, Ohio or a similarly named city. The practice provides general and family dentistry services, including routine cleanings, examinations, fillings, and preventive care for patients of all ages. It operates within the healthcare and dental services industry, serving local community members in a private practice setting. |
||||||
| Ransomware | Stadler Rail id31282 View details | Switzerland | Manufacturing / Engineering | leaked | ||
|
Stadlerrail.com is a company based in Switzerland, operating in the manufacturing and engineering sector. The company likely provides rail-related products or services, given its name. Stadlerrail.com was listed as a ransomware victim associated with Everest. |
||||||
| Ransomware | Stadler Rail id31282 View details | Switzerland | Manufacturing / Engineering | leaked | ||
|
[AI generated] Stadler Rail is a Swiss manufacturer of railway vehicles headquartered in Bussnang, Switzerland. Founded in 1942, the company designs and produces a wide range of trains including regional and intercity trains, trams, metros, and rack railways. It operates globally, supplying rail operators across Europe, the Americas, and beyond, and is recognized for its FLIRT and KISS train families. |
||||||
| Ransomware | Keysight id31284 View details | United States | Manufacturing / Engineering | leaked | ||
|
Keysight Technologies is a US-based company that operates in the manufacturing and engineering sector, offering a range of products and services. The company is headquartered in the United States and provides electronic design and test solutions. Keysight Technologies was listed as a ransomware victim associated with Everest. |
||||||
| Ransomware | Keysight id31284 View details | United States | Manufacturing / Engineering | leaked | ||
|
[AI generated] Keysight Technologies is an American electronic test and measurement company headquartered in Santa Rosa, California. It designs and manufactures instruments, software, and services used to design, emulate, and test electronic equipment. Its solutions support industries including aerospace, defense, communications, semiconductors, and automotive. Formerly part of Agilent Technologies, Keysight became an independent public company in 2014. |
||||||
| Ransomware | Asopagos S.A. id29407 View details | Colombia | Other | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | ЕРМ id29408 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | Spedition Kern id29422 View details | Germany | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Advanced Psychiatry Associates id29423 View details | United States | Healthcare / Pharma | leaked | ||
|
[AI generated] Advanced Psychiatry Associates is a psychiatric medical practice based in the United States. The company provides comprehensive mental health services, including evaluation, diagnosis, and treatment of psychiatric conditions such as depression, anxiety, ADHD, and bipolar disorder. It operates within the healthcare and behavioral health industry, offering both medication management and therapy services to adult and adolescent patients across its clinic locations. |
||||||
| Ransomware | Sidra Kuwait Hospital id29424 View details | Kuwait | Healthcare / Pharma | — | ||
|
[AI generated] Sidra Kuwait Hospital is a private healthcare facility located in Kuwait. It provides a range of medical and clinical services to patients, including diagnostics, outpatient consultations, and specialized treatments. Operating within the private healthcare sector in Kuwait, the hospital serves both local residents and expatriates, contributing to the country's growing private medical infrastructure alongside public health institutions. |
||||||
| Ransomware | VVO Finance id29425 View details | Germany | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | AKM id29426 View details | Japan | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | TransferZ id29441 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | L&P Aesthetics id29442 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Rehab Clinics Group Ltd id28943 View details | United Kingdom | Healthcare / Pharma | — | ||
|
[AI generated] Rehab Clinics Group Ltd is a UK-based healthcare company specialising in rehabilitation and addiction treatment services. Operating across England, it provides residential and outpatient programmes for individuals dealing with substance misuse, alcohol dependency, and mental health conditions. The company works with private patients and NHS referrals, offering medically supervised detox, therapy, and aftercare support through a network of treatment centres. |
||||||
| Ransomware | Studio Marchi - Studio Professionale Associato id28865 View details | Italy | Finance / Legal / Insurance | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Fiserv id28792 View details | United States | Finance / Legal / Insurance | leaked | ||
|
[AI generated] Fiserv is a global financial technology company headquartered in Milwaukee, Wisconsin, United States. It provides financial services technology solutions including payment processing, core banking systems, digital banking platforms, and merchant acquiring services. Serving banks, credit unions, retailers, and businesses worldwide, Fiserv operates across the fintech and banking technology industry and is one of the largest providers of financial services infrastructure globally. |
||||||
| Ransomware | Symcor id28329 View details | Canada | Finance / Legal / Insurance | — | ||
|
[AI generated] Symcor is a Canadian business process outsourcing company that provides payment processing, data management, and document services primarily to financial institutions. Founded in 1996 and headquartered in Mississauga, Ontario, it serves major banks and other clients across Canada. Its core services include cheque processing, statement production, and digital transaction solutions, helping organizations streamline operations and manage large volumes of financial data securely. |
||||||
| Ransomware | TSYS id28330 View details | United States | Finance / Legal / Insurance | leaked | ||
|
[AI generated] TSYS, or Total System Services, is a US-based payment solutions company headquartered in Columbus, Georgia. It operates in the financial technology and payment processing industry, providing services such as credit and debit card processing, merchant services, and payment management solutions to financial institutions, businesses, and consumers worldwide. TSYS became a subsidiary of Global Payments following a merger in 2019. |
||||||
| Ransomware | Epiq Global id28331 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] Epiq Global is a US-based legal services company specializing in technology-driven solutions for complex legal matters. It provides services including class action and mass tort administration, bankruptcy case management, eDiscovery, document review, and legal notification. Operating across multiple countries, Epiq serves law firms, corporations, and government entities, helping manage large-scale legal proceedings efficiently. |
||||||
| Ransomware | Liberty Mutual Insurance id28414 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] Liberty Mutual Insurance is a leading American insurance company headquartered in Boston, Massachusetts. Founded in 1912, it operates in the property and casualty insurance industry, offering products such as auto, home, life, and commercial insurance. The company serves individuals and businesses across the United States and internationally, making it one of the largest global insurers by premium revenue. |
||||||
| Ransomware | Morae id28422 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] Morae is a US-based professional services company specializing in legal, compliance, and technology consulting. It serves law firms, corporate legal departments, and financial institutions by providing managed services, litigation support, contract lifecycle management, and legal operations solutions. The company combines legal expertise with advanced technology to help clients improve efficiency, reduce costs, and manage risk across their legal and compliance functions. |
||||||
| Ransomware | Indonesia's Customs Analytics Platform id28496 View details | Indonesia | Public Sector | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Super AI id28512 View details | Germany | IT | — | ||
|
Automate business processes end-to-end with guaranteed results using super.AI Intelligent Document Processing (IDP). Quickly extract data from complex documents using the latest AI models. |
||||||
| Ransomware | Nutrabio id28743 View details | United States | Agriculture / Food | — | ||
|
[AI generated] NutraBio is a US-based dietary supplement manufacturer founded in 1996 and headquartered in Middlesex, New Jersey. The company operates in the health and wellness industry, producing sports nutrition products including protein powders, pre-workouts, vitamins, and recovery supplements. NutraBio is known for its commitment to transparency, using fully disclosed labels and manufacturing products in an FDA-registered, cGMP-certified facility. |
||||||
| Ransomware | Umiles Group id28744 View details | Spain | Transportation / Travel / Logistics | leaked | ||
|
[AI generated] Umiles Group is a Spanish technology and services company specializing in drone operations, urban air mobility, and advanced aerial solutions. Based in Spain, it provides unmanned aerial vehicle services for sectors including logistics, inspection, surveillance, and emergency response. The company also focuses on developing regulatory frameworks and training programs to support the integration of drones into civil airspace across Europe. |
||||||
| Ransomware | Complete Aircraft Group id28745 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Tokoparts id28746 View details | Indonesia | Retail / E-commerce | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Citizens Bank id28747 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] Citizens Bank is a major American retail and commercial bank headquartered in Providence, Rhode Island. Operating within the financial services industry, it offers a wide range of products including personal and business banking, loans, mortgages, credit cards, and wealth management services. It serves millions of customers across the United States through branches, ATMs, and digital banking platforms. |
||||||
| Ransomware | Frost Bank id28748 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] Frost Bank is a Texas-based financial institution and a subsidiary of Cullen/Frost Bankers, Inc. Founded in 1868 and headquartered in San Antonio, it operates across major Texas cities offering personal and commercial banking, wealth management, insurance, and investment services. As one of the largest independent banks in Texas, it serves individuals, businesses, and institutions within the United States financial services industry. |
||||||
| Ransomware | K Subsea Group id28098 View details | Singapore | Energy | leaked | ||
|
K Subsea is a Singapore based company focused on providing integrated subsea solutions to the energy industry. We have over 800 employees across SEA, both on and offshore |
||||||
| Ransomware | Nissan id27786 View details | Japan | Manufacturing / Engineering | leaked | ||
|
[AI generated] Nissan Motor Co., Ltd. is a leading Japanese multinational automotive manufacturer headquartered in Yokohama, Japan. It was established in 1933 and is known for producing a wide range of vehicles, such as SUVs, sedans, electric/ hybrid cars and commercial vehicles. It is part of the Renault–Nissan–Mitsubishi Alliance, which is one of the world's largest automotive partnerships. |
||||||
| Ransomware | Parque Eólico Toabré id27762 View details | Panama | Energy | leaked | ||
|
[AI generated] Parque Eolico Toabre is a wind farm based in Panama operated by Union Eolica Panameña. With a total capacity of 55 MW produced by 22 wind turbines, it contributes significantly to generating renewable energy. In addition to lowering the country's reliance on fossil fuels, the wind farm represents a sustainable solution for producing electricity. |
||||||
| Ransomware | PT Brantas Abipraya id27756 View details | Indonesia | Construction / Real Estate | deleted | ||
|
[AI generated] PT Brantas Abipraya is a state-owned Indonesian construction company. It was established in 1980 with the main objective to develop water infrastructure including dams, irrigation systems, and hydroelectric power plants. In recent years, the company has expanded its scope to cover other construction works such as airports, roads, bridges, buildings, and other civil infrastructure projects. |
||||||
| Ransomware | Straight Line Logistics id27753 View details | United Arab Emirates | Transportation / Travel / Logistics | — | ||
|
[AI generated] Straight Line Logistics is a Houston based company, specializing in transportation and logistics solutions. They offer a wide range of services, including truckload freight, intermodal transportation, warehousing, and supply chain management. Their team of experienced professionals focuses on providing efficient, reliable, and cost-effective solutions to their clients' logistic needs. |
||||||
| Ransomware | Evaluate a Norstella company id27348 View details | Norway | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | First Priority Group id27223 View details | United States | Communication / Marketing | leaked | ||
|
[AI generated] First Priority Group is a diversified manufacturer, dealer, up-fitter, and service provider of emergency and specialty vehicles. The company provides ambulance remounts, emergency vehicle parts, and services. It also designs and manufactures vehicle command centers for the law enforcement and public safety sectors. Based in New Jersey, it has been serving customers across the USA since 1998. |
||||||
| Ransomware | Hyundai Elevator id27133 View details | Korea, Republic of | Manufacturing / Engineering | leaked | ||
|
[AI generated] Hyundai Elevator Co., Ltd is a South Korean company specializing in the production of elevators, escalators, and related equipment. Established in 1984, Hyundai Elevator is a part of the Hyundai Group. It offers comprehensive services that include designing, manufacturing, installing and maintaining a variety of systems including moving walkways, dumbwaiters, and parking systems. It operates mainly in the domestic market but has expanded globally. |
||||||
| Ransomware | UD Trucks id26916 View details | Japan | Communication / Marketing | leaked | ||
|
[AI generated] UD Trucks is a Japan-based company that designs, manufactures, and distributes transport solutions ranging from heavy-duty to medium-duty trucks. It is well-recognized for its reliable and high-quality products. Originally founded in 1935 as Nihon Diesel Industries, it was acquired by Volvo in 2007. UD Trucks operates globally with a primary focus on Asia and Africa. |
||||||
| Ransomware | 111 id26850 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | Boltech id26811 View details | Poland | IT | — | ||
|
[AI generated] Boltech is a company that provides services for industrial automation and electrical installations. In addition, Boltech offers a range of electrical and energy solutions to various sectors including aviation, automotive, and logistics. The company prides itself on providing innovative solutions by using the latest technology to ensure efficient and sustainable results for their clients. |
||||||
| Ransomware | Atlas Air: MUSE INSECURE id26609 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Tsunami Tsolutions id26436 View details | United States | Services | — | ||
|
[AI generated] Tsunami Tsolutions is a tech company offering IT services and software solutions to key domains, mainly aviation and manufacturing. Their offerings include data procurement and analysis, MRO, supply chain management, and reliability prediction software. It undertakes and manages its customers' technological tasks, aiding them in strategizing and enhancing their business performance. |
||||||