Loading story…
Svenska kraftnät, Sweden’s state-owned power grid operator, confirmed a data breach after the Everest ransomware group claimed responsibility for stealing approximately 280 GB of internal data. The incident was limited to an external file transfer system and did not impact the country’s electricity supply or mission-critical systems. The company is collaborating with police and national cybersecurity authorities to assess the scope of the breach and determine what information may have been exposed, while refraining from attributing the attack until further confirmation is available.
Everest threatened to publish the stolen data unless its demands were met, posting the claim on its leak site. The group has previously claimed responsibility for attacks on other major organizations, though these claims have not always been independently verified. Svenska kraftnät’s Chief Information Security Officer emphasized that immediate action was taken and reassured the public that the electricity supply remains unaffected. The investigation is ongoing, and the company has not commented on the perpetrators or their motives at this stage.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Sweden’s power grid operator confirmed that it had suffered a data breach following the ransomware gang’s claim. This marked the organization’s official acknowledgment of the incident.
The Everest ransomware group publicly claimed it had breached Sweden’s power grid operator, Svenska kraftnät, and asserted it had stolen data from the organization. The claim was later echoed across multiple reports, but represents a single disclosure event.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Stadler Rail said a cyberattack targeted a data-exchange platform operated by one of its suppliers after attackers obtained compromised login credentials, allowing access to certain technical data. The company said its own internal IT systems were not breached, production continued normally, and no sensitive personal data was stolen; it also reported that the incident did not create any safety risk and later indicated the situation was under control. The attackers were identified as the **Everest** group, which reportedly demanded **10 million Swiss francs** in ransom after the data theft. Stadler said it would not pay, filed a criminal complaint, and stated that no confirmed data loss had been established beyond the accessed supplier-platform information.
Jul 23, 2026
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026
The Everest ransomware group has publicly claimed responsibility for a significant breach of ASUS, a leading global hardware and electronics manufacturer. According to statements posted on a dark web leak site, Everest alleges it has stolen over 1TB of data from ASUS, including proprietary camera source code, firmware, and potentially other sensitive intellectual property. The group has demanded that ASUS contact them via the encrypted messaging platform Qtox within 21 hours, though no ransom amount has been disclosed. At this time, ASUS has not confirmed or denied the breach, and the exact nature and sensitivity of the compromised data remain unverified. This incident follows a pattern of recent Everest ransomware claims against other high-profile organizations, such as Under Armour, Petrobras, and Iberia airline, which involved theft of user data and internal documentation. If substantiated, the breach would represent a major compromise for ASUS, which previously suffered the ShadowHammer supply chain attack in 2019. The situation underscores the ongoing threat posed by ransomware groups to major technology manufacturers and the potential for large-scale intellectual property theft and operational disruption.
Jun 29, 2026