Loading story…
The Everest ransomware group claims to have exfiltrated data from more than 600,000 Clarins customers across the U.S., Canada, and France. Exposed information includes names, birthdates, addresses, emails, and phone numbers, with potential for phishing exploitation. The breach follows a similar recent claim against Allegis Group by the same threat actor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026
**Everest ransomware** claimed responsibility for a breach tied to *Catalyst RCM*, a third-party medical billing/revenue cycle management provider, resulting in exposure of data associated with diagnostic firm **Vikor Scientific** (now operating as **Vanta Diagnostics**) and affiliated labs. Reporting indicates suspicious activity was detected in Catalyst RCM’s secure file system in November 2025, with investigation finding misuse of an authorized login to access a server and copy data without permission. The incident was reported as affecting roughly **139,964–140,000 individuals**, and Everest later posted the victim(s) to its Tor leak site and published allegedly stolen files after an apparent failure to reach payment. Stolen data described across reporting includes a mix of **personal, financial, and healthcare information**, potentially including names, dates of birth, payment card data, and medical/diagnosis details; Everest also claimed theft of specific datasets (e.g., tens of thousands of PDFs totaling multiple gigabytes). Catalyst RCM reviewed the exposed information to determine impacted individuals and support notification efforts. Separate reporting on a ransomware-driven clinic shutdown at the **University of Mississippi Medical Center** describes a different, unrelated incident with no confirmed linkage to Everest or Catalyst RCM.
Jun 29, 2026
The **Everest** ransomware group publicly claimed two separate victim intrusions, alleging large-scale data theft and using leak-site pressure tactics. Everest posted that it breached **McDonald’s India**, claiming exfiltration of **861 GB** of customer data and internal documents and sharing screenshots purportedly showing financial reports, audit trails, pricing data, internal communications, and month-by-month directories suggestive of access to accounting/ERP systems. The leak claim also referenced a “Contact Database” spreadsheet with personal and business details of investors/partners across multiple countries and store-level operational data (e.g., manager names and contact numbers), alongside a short deadline for the company to respond. Separately, **Have I Been Pwned (HIBP)** reported ingesting files allegedly leaked by an Everest member that impacted **72.7 million Under Armour accounts**, with exposed fields including names, email addresses, dates of birth, gender, location, and purchase-related details; Everest additionally claimed other data types (e.g., phone numbers, addresses, loyalty details) and had previously threatened publication unless a ransom was paid. Under Armour had not publicly acknowledged the alleged incident at the time of reporting, and a proposed class action lawsuit was filed following Everest’s initial leak-site posting. A third report about **RansomHub** claiming an intrusion at Apple partner **Luxshare** describes a different ransomware operation and does not appear connected to the Everest claims.
Jun 29, 2026