Evaluate a Norstella company listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Norway
• Announcement date: March 15, 2026

Everest ransomware group claims data breach at Evaluate a Norstella company

The Everest ransomware group has officially listed Evaluate a Norstella company on its dedicated leak site, claiming to have successfully executed a data breach against the organization. This announcement, made on March 15, 2026, suggests that the threat actor has gained unauthorized access to the company's internal systems, potentially compromising sensitive operational and personal information.

According to the claims made by the Everest group, the attackers managed to gain access to the organization's FTP servers. These servers were reportedly used to store sensitive data, which the group now alleges has been exfiltrated. The timing of the announcement, coinciding with the claimed date of the attack, indicates that the group intends to use the stolen information as leverage, a tactic commonly associated with modern ransomware operations.

Details of the allegedly stolen data

While the specific volume and exact count of the files taken have not been disclosed by the group, the contents of the breach appear to be significant. Based on available screenshots provided by the threat actor, the compromised data includes a variety of highly sensitive information types. The breach reportedly affects multiple layers of the organization's data, ranging from clinical information to corporate intelligence.

The data allegedly leaked includes the following:

• Patient health records, specifically patient-level oncology records
• Employee records
• Corporate research data, including documents related to the unauthorized redistribution of European broker research
• US facility identifiers (NPI)
• Addresses

The inclusion of patient-level oncology records and US facility identifiers suggests that the breach may impact highly regulated medical information, while the presence of employee records and corporate research documents points to a broad compromise of both personal and proprietary organizational data.

About Evaluate a Norstella company

Norstella is a global life sciences company that provides data analytics, consulting, and technology solutions to optimize drug development and commercialization processes. The company offers strategic support to the pharmaceutical industry, ranging from clinical trials to market access.

Potential impact and industry implications

This incident may undermine the organization's credibility in the data analytics sector and pose risks to its proprietary intelligence. The exposure of patient data could lead to legal consequences for the company under regulations such as GDPR and HIPAA. Furthermore, the leakage of employee records may create opportunities for identity theft or targeted phishing attacks against staff members.

Given the past activities of the Everest group, it is possible that this data could be used for secondary extortion or sold to third parties. In such scenarios, ransomware groups often employ a double extortion tactic, where they not only encrypt systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. Even if a ransom is not paid, the data may still be sold on dark web forums, leading to long-term reputational and legal challenges.

For organizations operating in the life sciences and data analytics sectors, such incidents highlight the critical importance of securing all entry points, including FTP servers. Robust data protection processes, regular security audits, and strict access controls are essential defensive steps. Additionally, organizations must be prepared to fulfill legal obligations, such as notifying affected parties and regulatory bodies, when sensitive personal or health information is compromised. Proactive monitoring and a well-defined incident response plan are vital to mitigating the impact of such sophisticated cyber threats.