Air Miles España, S.A listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Spain
• Sector: Transportation
• Announcement date: November 24, 2025

Everest ransomware group claims data breach at Air Miles España, S.A

The ransomware group known as Everest has listed Air Miles España, S.A on its leak site, alleging a significant data breach. According to the announcement published on December 8, 2025, the group claims that the organization's databases have been compromised. This development follows an earlier claim regarding the attack date on November 24, 2025.

The Everest group is described as a Russian-speaking entity that has been active since 2020. The group is known for engaging in various cybercriminal activities, including data theft, extortion, and the sale of unauthorized access to compromised networks. Such groups often utilize leak sites to pressure victims into paying ransoms by threatening to release sensitive information to the public.

Details of the alleged leak

Regarding the specifics of the incident, the group has not provided detailed information concerning the content of the leak. While the announcement asserts that the organization's databases have been compromised, no specific details regarding the nature of the data or the volume of the information have been provided. The listing does not specify the amount of data stolen or the number of files involved.

The listing names no specific data types that have been compromised.

Analysis of the threat actor

The activities attributed to Everest are consistent with modern ransomware tactics. Many such groups employ a strategy known as double extortion. In a double extortion scenario, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive data before the encryption occurs. The threat of leaking this stolen data on a public forum serves as additional leverage to force the victim into paying the ransom demand.

About Air Miles España, S.A

Air Miles España, S.A. is a company operating in Spain that provides loyalty program services under the Travel Club brand. The organization manages a platform that allows customers to earn points from their shopping and travel expenses and redeem them for various rewards.

Potential impact and organizational risks

This claim may indicate a risk of exposure for the organization's customer data and operational information. Because the organization is based in Spain, a potential data breach could lead to legal sanctions under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict data protection standards, and failures in security can result in significant regulatory scrutiny and fines.

For the individuals whose data may have been affected, there is an increased risk of identity theft and targeted phishing attacks. When personal information is leaked, attackers often use it to craft highly convincing fraudulent communications designed to trick users into revealing further credentials or financial information.

In the transportation and loyalty services sector, maintaining the integrity of customer databases is critical for operational continuity and consumer trust. Organizations facing such threats often focus on defensive measures such as implementing multi-factor authentication, maintaining robust backup strategies, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.