Dharma Group listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Italy
• Announcement date: August 5, 2026

Everest ransomware group claims data breach at Dharma Group

The ransomware group known as Everest has listed the Italian logistics company Dharma Group on its dedicated leak site. According to the announcement made on August 5, 2026, the threat actors claim to have successfully exfiltrated a significant amount of data from the organization's systems.

The group alleges that the initial breach or unauthorized access occurred on July 17, 2026. Following the claim of access, the threat actors have reportedly provided a timeframe for the organization to establish contact with them to resolve the situation. While the group has published the organization's name on their platform, no specific ransom demand has been disclosed in the announcement.

Details of the alleged data exfiltration

The Everest group claims to be in possession of a massive dataset totaling 125 GB. This collection is reported to consist of approximately 27,000 files. The breadth of the information described in the leak claim suggests a deep penetration into various administrative and operational layers of the company.

The specific types of data mentioned in the announcement include a wide array of sensitive corporate and operational records. The reported content covers:

• Manufacturing operation data
• HR records
• Customer delivery data
• Supplier data
• Engineering drawings
• Stock reports

Beyond these primary categories, the group claims the stolen data includes manufacturing operations, delivery administration, HR and production planning records, customer delivery workflows, HR delivery records, technical records, barcode and part tag data, delivery notes, tender documents, production planning records, loading capacity records, delivery records, forecast records, stock reports, attendance and overtime records, engineering drawings, training data, and digital transformation records.

About Dharma Group

Dharma Group is an Italy-based logistics company that provides a variety of international services. Their operational scope includes international freight forwarding, shipping, and customs brokerage services. The company maintains a presence across multiple transport modes, operating in sea, air, and road transport, while also providing comprehensive supply chain management solutions.

Analysis and potential impact of the incident

The Everest group is identified as a Russian-speaking threat actor that has been active since 2020. This group is known for utilizing tactics such as data exfiltration, extortion, and the sale of unauthorized access to third parties. The nature of the data claimed to be stolen suggests that the organization may face significant challenges regarding operational continuity and commercial reputation.

Because Dharma Group is based in Italy, this incident may trigger legal and administrative sanctions under the European Union's General Data Protection Regulation (GDPR). The presence of employee and supplier information within the alleged leak introduces secondary risks, such as the potential for identity theft and highly targeted phishing attacks against the company's partners and staff.

The group's historical behavior suggests they may employ double extortion tactics. In such scenarios, attackers not only encrypt systems to disrupt operations but also steal sensitive data to use as leverage, threatening to publish it if the ransom is not paid. Such tactics significantly increase supply chain risks for all connected entities. To mitigate these risks, organizations in the logistics and supply chain sectors typically focus on robust data encryption, strict access controls, and continuous monitoring of network traffic to detect unauthorized exfiltration attempts early.