Dublin Airport allegedly targeted by Everest ransomware group

• Ransomware group: Everest
• Country: Ireland
• Sector: Transportation
• Announcement date: October 26, 2025

The Everest ransomware group has published an announcement on its leak site, claiming to have successfully targeted Dublin Airport. According to the post made on October 26, 2025, the threat actor group alleges that they have exfiltrated a massive amount of sensitive information belonging to the Irish transportation hub.

The alleged breach and group claims

The Everest group created a dedicated post on their leak site to announce the attack. In this announcement, the group alleges that they have stolen 1,533,900 personal records from the organization. To demonstrate the validity of their claim, the group has reportedly made a portion of this stolen data accessible to the public by providing download links for database files.

This type of activity is characteristic of modern ransomware operations, which often employ a strategy known as double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive data. By threatening to release this data on public leak sites, the group aims to exert maximum pressure on the victim to meet their demands. This tactic shifts the leverage from simple operational disruption to the threat of massive regulatory fines and reputational damage.

Data involved in the alleged leak

The leak announcement specifies that the stolen dataset is quite extensive, containing 1,533,900 personal records. The information allegedly taken from the organization's systems includes highly specific passenger details that could be used for various malicious purposes. According to the group's claims, the compromised data includes:

• Passenger names
• PNR codes
• Flight routes
• Seat numbers
• Ticket types
• Flight details

The exposure of such granular information, particularly PNR (Passenger Name Record) codes and flight specifics, presents a significant risk. Such data is often utilized by malicious actors to conduct highly targeted phishing attacks or to facilitate identity theft, as the information provides a realistic context for fraudulent communications.

Organization profile

Dublin Airport is the international airport serving Dublin, Ireland, and is the busiest airport in the country. Operated by DAA (Dublin Airport Authority), the facility serves an extensive network of domestic and international flights.

Impact and industry implications

This alleged breach may increase the risk of identity theft and targeted phishing attacks for the affected passengers. Because the institution is based in Ireland, the incident may be subject to review under the General Data Protection Regulation (GDPR) and by relevant data protection authorities. The scale of the claimed data theft suggests that the incident could potentially impact the institution's operational processes and passenger trust.

Furthermore, such incidents raise significant concerns regarding supply chain security within the aviation sector. The interconnected nature of modern transportation means that a breach in one major hub can have ripple effects across the industry. For organizations operating in this sector, maintaining robust defensive postures is critical. This typically involves implementing strict access controls, continuous monitoring of network traffic for unusual exfiltration patterns, and ensuring that third-party vendors adhere to rigorous cybersecurity standards to prevent vulnerabilities in the supply chain.

Given the past activities of the Everest group, it can be observed that the group aims to exert pressure through data extortion and leak tactics. As organizations face increasing pressure from these sophisticated actors, the focus on data loss prevention and rapid incident response becomes a cornerstone of modern cybersecurity strategy.