Accounting Professionals LLC. Price, Breazeale & Chastang targeted by Everest ransomware

• Ransomware group: Everest
• Country: United States
• Sector: Professional Services
• Announcement date: May 4, 2024

The Everest ransomware group has officially listed Accounting Professionals LLC. Price, Breazeale & Chastang on its leak site, claiming to have successfully exfiltrated a significant amount of data from the organization. This announcement, made on May 4, 2024, marks the beginning of a targeted extortion process directed at the Florida-based firm.

The details of the claim

According to the threat actor known as Everest, the organization has been targeted in a data exfiltration attack. The group has initiated an extortion process by publicly naming the firm on their dedicated leak site. In their announcement, the attackers stated that they have provided the organization with a 24-hour window to establish contact with the group.

The threat actor has issued a direct ultimatum regarding the timeline of this incident. The group claims that if no response is received within this specified 24-hour timeframe, they will proceed to publish the stolen information. This tactic is a common feature of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

Data involved in the incident

The announcement specifies that the volume of data involved in this breach is approximately 574 GB. The attackers claim that this massive dataset contains sensitive documentation belonging to a large number of individuals and entities. Specifically, the group alleges that the stolen files include documents from over 2,000 clients of the firm.

Affected data types

• Client documents

About Accounting Professionals LLC. Price, Breazeale & Chastang

Price, Breazeale & Chastang is an accounting and tax consulting firm based in Florida. The organization provides a variety of specialized services to its client base, including tax planning, auditing, and financial advisory services. They serve both individual and corporate clients, managing a wide range of financial and regulatory documentation through their professional service operations.

Analysis and potential implications

The Everest group is a known threat actor that has been involved in data exfiltration and extortion activities since 2020. Because the targeted organization operates within the professional services sector, there is a high possibility that the exfiltrated data contains sensitive financial and personal information. The nature of accounting and tax consulting means that the firm handles highly confidential client records, which increases the potential impact of a leak.

This situation may lead to significant legal and regulatory consequences for the firm under relevant US state laws and federal regulations. For the clients whose data is allegedly at risk, secondary dangers may emerge, such as the potential for identity theft and the risk of targeted phishing attacks. Furthermore, the failure to protect this data could result in a loss of client trust and long-term reputational damage for the firm.

In general, organizations in the professional services sector can take several defensive steps to mitigate such risks. Implementing robust data encryption, enforcing multi-factor authentication, and maintaining rigorous access controls are standard industry practices. Additionally, regular security audits and comprehensive employee training regarding phishing and social engineering can help strengthen an organization's defensive posture against sophisticated threat actors like Everest.