Air Arabia listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: United Arab Emirates
• Sector: Transportation
• Announcement date: October 25, 2025

Everest group claims to have targeted Air Arabia

The threat actor group known as Everest has listed the United Arab Emirates-based airline Air Arabia on its dedicated leak site. According to the announcement, the group claims to have successfully targeted the organization and is now offering a database belonging to the company for sale. The claim was made on October 25, 2025, and the announcement remains active on the group's digital platform.

Ransomware groups often utilize leak sites to increase pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The threat of leaking this stolen data on a public platform serves as a powerful lever to coerce the victim into paying a ransom. By making the breach public, the group aims to damage the victim's reputation and create legal or regulatory pressure, thereby increasing the likelihood of a successful extortion attempt.

Details of the alleged extortion attempt

The Everest group has officially announced that they are offering a database belonging to Air Arabia for a ransom demand of 2,000,000 USD. While the group has posted a screenshot to support their claim, the specific details regarding the content of the leaked data remain unknown. The listing does not provide information regarding the volume of the data or the specific file count involved in the alleged breach.

The listing names no specific data types that have been compromised.

The Everest threat group

The Everest group is identified as a Russian-speaking entity that has been active since 2020. The group specializes in various cybercriminal activities, including data theft, extortion, and the sale of unauthorized access to corporate networks. Their operational model relies heavily on the exploitation of vulnerabilities to gain entry into high-value targets, followed by the exfiltration of data to be used in subsequent ransom negotiations.

About Air Arabia

Air Arabia is a low-cost airline based in the United Arab Emirates. Headquartered in Sharjah, the company operates scheduled flights to numerous destinations across the Middle East, North Africa, Asia, and Europe.

Potential risks and organizational implications

This claim by the Everest group may pose significant risks to the organization's operational continuity and customer trust. If the breach is confirmed, secondary risks may occur, such as the exposure of passenger data and potential legal proceedings under regional data protection regulations. The potential for such an incident highlights the critical importance of robust cybersecurity frameworks in the transportation sector.

For organizations operating in the transportation industry, maintaining the integrity of passenger and operational data is vital. When faced with potential data breaches, organizations are generally advised to conduct thorough reviews of their internal systems to identify vulnerabilities. Implementing comprehensive security measures, such as multi-factor authentication, advanced encryption for data at rest and in transit, and continuous monitoring of network traffic, can help mitigate the impact of such attacks. Furthermore, organizations should prepare for incident response and ensure they have clear protocols for communicating with regulatory bodies and affected customers should a breach be verified.