Everest 2026 activity
Ransomware group. 9 reports in 6 countries: 1 confirmed, 8 claimed or disputed. Latest 27 Oct 2026.
Singapore · 
United Arab Emirates · 
Sweden · 
Colombia · 
Indonesia · 
Taiwan
🎯 What sources say
- Singapore: Listed Bolttech, K Subsea Group and an unnamed Singapore energy storage terminal in 2026. ransomware.live ransomware.live
- Indonesia: Claimed the customs analytics platform and BUMN contractor Brantas Abipraya in March and April 2026. ransomware.live ransomware.live
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
| ⚠️ ClaimedUnnamed energy storage terminal | Singapore | 27 Oct 2026 | Energy | Ransomware | Everest | Claimed. Everest lists an unnamed Singapore energy storage terminal on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ Claimedflydubai | United Arab Emirates | 7 Oct 2026 | Transport | Ransomware | Everest | Claimed. Everest listed the airline and claimed 4.36 GB of data, including records on 2,862 employees and pilot training material. No samples were published. | Cybernews · TechInformed✓ 8 Nov |
 ⚠️ ClaimedSecuritas | Sweden | 25 Sep 2026 | Other | Ransomware | Everest | Claimed. Everest listed Securitas Group on its leak site, said all company data was encrypted and threatened a leak. | DeXpose✓ 8 Nov |
 ⚠️ ClaimedEmpresas Públicas de Medellín (EPM) | Colombia | 5 Aug 2026 | Energy | Data leak | Everest | Claimed. Everest listed the Medellín utility on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedDirektorat Jenderal Bea dan Cukai (customs analytics platform) | Indonesia | 28 Apr 2026 | Government | Ransomware | Everest | Claimed. Everest claimed about 44.86 GB in 437 files from a customs analytics system, including Power BI audit models and about 173,292 corporate tax ID records, with a short publication deadline. | ransomware.live · Reskrim Polda News✓ 7 Nov |
 ⚠️ ClaimedK Subsea Group | Singapore | 13 Apr 2026 | Energy | Ransomware | Everest | Claimed. The Everest group listed K Subsea Group on its leak site on 2026-04-13. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPT Brantas Abipraya (BUMN) | Indonesia | 31 Mar 2026 | Property | Ransomware | Everest | Claimed. Everest listed the state-owned construction company on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedBolttech | Singapore | 21 Jan 2026 | Finance | Ransomware | Everest | Claimed. The Everest group listed Bolttech on its leak site on 2026-01-21. | ransomware.live✓ 7 Nov |
 ✅ ConfirmedASRock Rack (永擎電子)Via a vendor | Taiwan | 20 Jan 2026 | Manufacturing | Intrusion | Everest | Confirmed. The listed company disclosed that an outsourced vendor's credentials leaked. It said affected access covered only website data and specific production test programs. Claimed. The Everest ransomware group claimed the company on 20 January. | iThome✓ 8 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology