Everest Ransomware Extortion Claims Target McDonald’s India and Under Armour

The Everest ransomware group publicly claimed two separate victim intrusions, alleging large-scale data theft and using leak-site pressure tactics. Everest posted that it breached McDonald’s India, claiming exfiltration of 861 GB of customer data and internal documents and sharing screenshots purportedly showing financial reports, audit trails, pricing data, internal communications, and month-by-month directories suggestive of access to accounting/ERP systems. The leak claim also referenced a “Contact Database” spreadsheet with personal and business details of investors/partners across multiple countries and store-level operational data (e.g., manager names and contact numbers), alongside a short deadline for the company to respond.

Separately, Have I Been Pwned (HIBP) reported ingesting files allegedly leaked by an Everest member that impacted 72.7 million Under Armour accounts, with exposed fields including names, email addresses, dates of birth, gender, location, and purchase-related details; Everest additionally claimed other data types (e.g., phone numbers, addresses, loyalty details) and had previously threatened publication unless a ransom was paid. Under Armour had not publicly acknowledged the alleged incident at the time of reporting, and a proposed class action lawsuit was filed following Everest’s initial leak-site posting. A third report about RansomHub claiming an intrusion at Apple partner Luxshare describes a different ransomware operation and does not appear connected to the Everest claims.