Crumbl listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: July 25, 2025

Everest claims data breach against Crumbl

The threat actor known as Everest has listed the US-based retail organization Crumbl on its dedicated leak site. The group claims that the data belonging to Crumbl has been leaked, signaling a potential security incident involving the organization's systems. This announcement, which was made on July 25, 2025, suggests that the threat actor's operation against the company has reached a stage where they claim the data is now accessible to the public.

According to the claims made by the Everest group, the breach allegedly occurred around July 23, 2025. By posting the organization on their leak site, the group indicates that they have completed their alleged operation and are moving forward with the dissemination of information. Such actions are characteristic of modern ransomware operations, where the goal is to use the threat of exposure to exert pressure on the target organization.

Details regarding the claimed leak

While the Everest group has officially announced the publication of data, specific details regarding the scope and nature of the information remain unclear. At this time, there is no detailed information regarding the content of the leaked data. The group has not provided specific documents or file samples that would allow for the identification of the exact nature of the data involved in this incident.

The listing on the leak site includes a screenshot displaying the phrase 'Full leak published.' However, despite this claim of completeness, no specific file counts, data sizes, or specific document types have been disclosed by the threat actor. Consequently, it remains unknown exactly what information, if any, has been compromised during this alleged attack.

About Crumbl

Crumbl is a prominent US-based cookie chain that has gained significant recognition for its unique business model. The company is well known for its rotating weekly menu and its signature pink boxes, which have become a recognizable part of its brand identity. Operating within the retail food sector, Crumbl maintains a large presence with numerous locations across the United States.

Risk assessment and industry implications

The claims made by the Everest group may pose significant risks to Crumbl's operational continuity and customer trust. Because the organization is based in the United States, a potential data breach could trigger various requirements under state-level data protection laws and other relevant regulations. The legal landscape for data protection in the US is complex, involving multiple jurisdictions and specific notification requirements depending on the nature of the data and the location of the affected individuals.

Considering the past activities of the Everest group, it is possible that any leaked data could be utilized for malicious purposes such as identity theft or targeted phishing attacks. In such scenarios, attackers use stolen information to impersonate individuals or to craft highly convincing fraudulent communications to deceive victims. Furthermore, secondary risks to the organization's supply chain partners may emerge, as a breach in one part of a retail network can sometimes create vulnerabilities for connected business partners.

This incident also highlights the use of double extortion tactics. In a double extortion scheme, ransomware groups do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to threaten its public release. This approach is designed to increase the pressure on the organization to pay the ransom, as the threat of a public leak can cause irreparable damage to reputation and brand loyalty. For organizations in the retail and e-commerce sectors, maintaining robust cybersecurity defenses and incident response plans is essential to mitigate these evolving threats.

Common defensive measures

To defend against such threats, organizations often implement several layers of security. These include:

• Data encryption: Protecting sensitive information both at rest and in transit.
• Multi-factor authentication: Adding a layer of security to prevent unauthorized access to systems.
• Regular backups: Ensuring that data can be restored in the event of a ransomware attack.
• Employee training: Educating staff to recognize and avoid phishing attempts.