Department of Culture and Tourism Abu Dhabi targeted by Everest ransomware group

• Ransomware group: Everest
• Country: United Arab Emirates
• Sector: Government & Defense
• Announcement date: July 12, 2025

Everest ransomware group claims breach of Abu Dhabi tourism entity

The ransomware group known as Everest has listed data allegedly belonging to the Department of Culture and Tourism Abu Dhabi on its leak site. This announcement, which appeared on the group's portal, suggests a targeted operation against the government institution in the United Arab Emirates.

Details of the claimed attack

According to the announcement published by the Everest group, the attack is claimed to have occurred on June 10, 2025. The group has asserted that they successfully compromised the systems of the Department of Culture and Tourism Abu Dhabi. To support their claim of a successful breach, the group has provided a download link for data that they allege was obtained from the institution's internal systems. As of the latest observation, the listing remains active on the group's leak portal, indicating that the threat remains an ongoing concern for the targeted entity.

Data involved in the incident

Regarding the specific nature of the information involved in this incident, no specific details regarding the content of the alleged leaked data have been provided; only a download link has been shared. The listing does not name any specific data types or categories of information that have been compromised.

About the Department of Culture and Tourism Abu Dhabi

The Department of Culture and Tourism Abu Dhabi is the government entity responsible for preserving the cultural heritage of the Emirate of Abu Dhabi, developing the tourism sector, and promoting the region as a global destination. As a public sector organization, it plays a vital role in the administrative and cultural landscape of the region.

Analysis and security implications

The Everest group has been known to utilize data exfiltration and extortion tactics since 2020. This method, often referred to as double extortion, involves stealing sensitive information before encrypting systems, allowing attackers to threaten the release of data if a ransom is not met. This incident may pose a risk of exposing the institution's sensitive administrative or operational information. Given the institution's public sector profile, it is assessed that the leak could have negative implications for its reputation and operational security. Furthermore, the leaked data may potentially be used for secondary attacks or targeted phishing campaigns against the organization or its stakeholders.

The group's past activities suggest that data may be made public if a ransom is not paid. In such scenarios, organizations often face the challenge of managing public perception and mitigating the fallout from leaked information. To defend against such threats, organizations in the government and defense sectors typically focus on robust data protection strategies. This includes implementing strict access controls, maintaining regular backups, and monitoring networks for unauthorized data exfiltration. Strengthening incident response plans and conducting regular security awareness training are also common defensive steps taken by organizations to mitigate the impact of ransomware and data theft.