Cybercrime

Everest Ransomware – Attack on the Leak Site and Its Consequences

„Don’t do crime. CRIME IS BAD xoxo from Prague“

In April 2025, the leak site of the Everest ransomware group was compromised by unknown hackers and defaced with the message „Don't do crime. CRIME IS BAD xoxo from Prague“. Shortly after, the site went offline.

Background on the Everest Ransomware Group

Since its founding in 2020, the Everest group has been responsible for numerous cyberattacks, including ones against the US space agency NASA and the Brazilian government. The group is known for its double-extortion strategy: it encrypts its victims' data and simultaneously threatens to publish sensitive information if a ransom is not paid.

Risks for affected companies

The recent compromise of the leak site poses significant risks to companies whose data was published there:
- Increased visibility: The media attention could cause other cybercriminals to notice the published data and use it for their own purposes.
- Reputational damage: The public disclosure of a data breach can lastingly damage the trust of customers, partners, and investors.
- Legal consequences: Companies could face fines or lawsuits due to data breaches.
- Further attacks: The published data could serve as the basis for further phishing or social engineering attacks.
Recommended measures for affected companies
1. Security check: A comprehensive analysis of the IT infrastructure to identify and fix further vulnerabilities.
2. Communication: Transparent information provided to customers, partners, and regulatory authorities regarding the incident and the measures taken.
3. Legal advice Review of potential legal obligations and risks by specialized cybercrime attorneys.
4. Prevention: Implementation of improved security protocols and regular employee training to raise awareness of cyber threats.
For more information on similar incidents, please see our Blog post about the LockBit ransomware group.

The law firm ATB.LAW offers companies comprehensive support in the area of ransomware and other cyber attacks. We have a dense network of selected IT specialists. Contact lawyer Roman Taudes under taudes@atb.law or by phone at +43 1 3912345.

Negotiating with cybercriminals: Professional support in the event of ransomware and data extortion

What companies need to do in the face of ransomware and data extortion: negotiating with the perpetrators, reporting obligations under the GDPR and NISG 2026, sanctions testing, and the legal limits of ransom payments in Austria.