Loading story…
The Everest extortion group claimed breaches affecting two organizations: Poly (an HP subsidiary, formerly Polycom) and Iron Mountain. Reporting on Poly indicates Everest alleged theft of roughly 90 GB of data, with shared samples suggesting potential exposure of C/C++ source code (possibly firmware/driver-related), screenshots referencing RMX video conferencing management systems, and hardware imagery; researchers cautioned the material may originate from an older database and that the presence of credentials is unconfirmed.
Iron Mountain disputed Everest’s broader claims of stealing 1.4 TB of sensitive internal and client data, stating the incident was limited to one folder on a public-facing file-sharing server accessed via a single compromised credential. Iron Mountain said the exposed content was primarily marketing materials shared with third-party vendors, the credential has been deactivated, no ransomware was deployed, and there was no evidence of broader system compromise or customer sensitive data exposure.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Reporting on February 4, 2026 said Everest claimed to have stolen 90 GB of data from Poly, an HP subsidiary. Reviewed samples allegedly included C/C++ code, possible firmware or source code references, RMX system screenshots, and a photo of a Polycom-manufactured chip.
Iron Mountain stated that attackers used a single compromised credential to access only one folder on a public-facing or third-party file-sharing server. The company said the exposed content was primarily marketing materials shared with vendors, with no ransomware, malware, or broader system compromise detected.
On February 2, 2026, Everest alleged on its leak site that it had stolen 1.4 TB of Iron Mountain internal documents and sensitive client data, posting screenshots as purported proof and setting a February 11 negotiation deadline.
In background reporting, Everest's leak site was taken down in April 2025 after being defaced with a message referencing Prague.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceupguard.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026
The **Everest** ransomware group publicly claimed two separate victim intrusions, alleging large-scale data theft and using leak-site pressure tactics. Everest posted that it breached **McDonald’s India**, claiming exfiltration of **861 GB** of customer data and internal documents and sharing screenshots purportedly showing financial reports, audit trails, pricing data, internal communications, and month-by-month directories suggestive of access to accounting/ERP systems. The leak claim also referenced a “Contact Database” spreadsheet with personal and business details of investors/partners across multiple countries and store-level operational data (e.g., manager names and contact numbers), alongside a short deadline for the company to respond. Separately, **Have I Been Pwned (HIBP)** reported ingesting files allegedly leaked by an Everest member that impacted **72.7 million Under Armour accounts**, with exposed fields including names, email addresses, dates of birth, gender, location, and purchase-related details; Everest additionally claimed other data types (e.g., phone numbers, addresses, loyalty details) and had previously threatened publication unless a ransom was paid. Under Armour had not publicly acknowledged the alleged incident at the time of reporting, and a proposed class action lawsuit was filed following Everest’s initial leak-site posting. A third report about **RansomHub** claiming an intrusion at Apple partner **Luxshare** describes a different ransomware operation and does not appear connected to the Everest claims.
Jun 29, 2026
**Everest ransomware** claimed responsibility for a breach tied to *Catalyst RCM*, a third-party medical billing/revenue cycle management provider, resulting in exposure of data associated with diagnostic firm **Vikor Scientific** (now operating as **Vanta Diagnostics**) and affiliated labs. Reporting indicates suspicious activity was detected in Catalyst RCM’s secure file system in November 2025, with investigation finding misuse of an authorized login to access a server and copy data without permission. The incident was reported as affecting roughly **139,964–140,000 individuals**, and Everest later posted the victim(s) to its Tor leak site and published allegedly stolen files after an apparent failure to reach payment. Stolen data described across reporting includes a mix of **personal, financial, and healthcare information**, potentially including names, dates of birth, payment card data, and medical/diagnosis details; Everest also claimed theft of specific datasets (e.g., tens of thousands of PDFs totaling multiple gigabytes). Catalyst RCM reviewed the exposed information to determine impacted individuals and support notification efforts. Separate reporting on a ransomware-driven clinic shutdown at the **University of Mississippi Medical Center** describes a different, unrelated incident with no confirmed linkage to Everest or Catalyst RCM.
Jun 29, 2026