AGFA targeted by Everest ransomware group in data leak announcement

• Ransomware group: Everest
• Country: Belgium
• Sector: Technology
• Announcement date: November 10, 2025

Everest ransomware group claims data leak involving AGFA

The ransomware group known as Everest has announced the publication of data allegedly belonging to AGFA on its leak site. This announcement, made on November 10, 2025, marks a significant development in the ongoing struggle between cybercriminal organizations and corporate entities. The group has officially listed the organization on their platform, claiming that they have successfully exfiltrated information during a recent attack.

The event involves a data leak announcement targeting AGFA, which was published by the Everest group on their own platform. According to the claims made by the threat actors, the institution failed to respond to their demands. As a consequence of this lack of response, the group asserts they have released the data they allegedly obtained via public links. Furthermore, it is stated that the data has been duplicated across various hacker forums and leak database sites, increasing the visibility of the alleged breach.

Details regarding the compromised information

While the group has provided a screenshot indicating that data has been leaked, there is no detailed breakdown regarding the specific types or content of the compromised information. The announcement does not specify the volume of the data or the exact nature of the files involved. Consequently, the listing names no specific data types or content categories.

The mechanics of double extortion

This incident follows a pattern often seen in modern cyberattacks known as double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive data. By threatening to release this information on public leak sites or forums, the attackers create additional pressure on the victim to meet their demands, moving beyond simple service disruption to direct reputational and legal leverage.

About AGFA

Agfa-Gevaert NV is a Belgian technology company that develops and manufactures medical imaging and IT solutions for hospitals and healthcare organizations, as well as industrial printing systems worldwide. Given its role in providing critical technology to the healthcare sector, the security of its data and systems is of paramount importance to its global operations.

Assessment and potential consequences

This incident suggests that corporate data belonging to AGFA may have been exposed to unauthorized parties. Given that the institution is based in Belgium, the breach could potentially lead to legal consequences under the EU General Data Protection Regulation (GDPR). The public release of this data may result in reputational damage for the institution and increase the risk of identity theft or targeted phishing attacks for its customers and employees.

Considering the methods of the Everest group, which has been active since 2020 and is known for data theft and extortion, it is assessed that the institution may remain vulnerable to secondary attacks. When data is leaked onto public forums, it often serves as a roadmap for other malicious actors to conduct follow-up campaigns.

Defensive considerations for technology and healthcare sectors

Organizations operating in the technology and healthcare sectors often face high-stakes risks due to the sensitive nature of the data they manage. To mitigate the risks associated with data exfiltration and ransomware, organizations typically implement several defensive layers. These include robust access controls to prevent unauthorized movement within a network, continuous monitoring to detect anomalous data transfers, and comprehensive encryption strategies to protect data both at rest and in transit.

Furthermore, maintaining a rigorous incident response plan is essential for managing the fallout of a potential breach. This includes preparing for the legal and regulatory requirements of frameworks like GDPR, which mandate strict reporting and protection standards. As threat actors continue to evolve their methods, maintaining a proactive security posture remains a critical necessity for protecting both corporate integrity and the privacy of end-users.