Evercover listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Hungary
• Sector: Manufacturing
• Announcement date: December 21, 2025

Inc Ransom claims Evercover data breach

The Inc Ransom ransomware group has listed the Hungarian manufacturing company Evercover on its dedicated leak platform. This announcement, made on December 21, 2025, serves as a claim by the threat actor group that they have successfully targeted the organization and obtained its data. The listing includes general information regarding the operations of the company, though it serves primarily as a notification of the alleged breach.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host announcements naming specific organizations to increase public visibility and pressure. When a group lists a company, it typically signals that negotiations have failed or that the group has moved into the extortion phase of their operation.

Details regarding the alleged data theft

At this stage of the incident, the Inc Ransom group has not provided specific details regarding the nature or the content of the alleged leaked data. There is no information available concerning the specific types of files, the total volume of data stolen, or the specific number of files involved in the incident. Furthermore, the group has not disclosed a ransom demand or any specific terms for the return of the data.

The listing names no data types at this time.

About Evercover

Evercover is a family business that was founded in 2013. The company specializes in the manufacturing of high-quality helmet covers. Their operations are global in scope, providing products to customers in over 70 countries worldwide.

Risk assessment and implications

Given the known tactics of the Inc Ransom group, there is a significant risk that sensitive company data could be published on the dark web. This group is known for employing double-extortion tactics. In a double-extortion scenario, attackers do not just encrypt a company's systems to disrupt operations; they also steal sensitive information to use as leverage. If the victims refuse to pay the ransom to decrypt their systems, the attackers threaten to leak the stolen data publicly to damage the company's reputation or force compliance through regulatory pressure.

Because Evercover operates in Hungary, this incident may involve potential violations of data protection obligations under the General Data Protection Regulation (GDPR). If the compromised data includes information belonging to employees or customers, those individuals may be exposed to various risks, such as identity theft or targeted phishing attacks. Such attacks often use stolen personal details to craft highly convincing fraudulent communications designed to trick individuals into revealing further sensitive information.

The group's past activities suggest that the publication of such data could potentially have negative impacts on the commercial reputation of the target organization. For companies in the manufacturing sector, a public data breach can lead to a loss of trust among international partners and customers. To mitigate such risks, organizations generally focus on robust defensive measures, including maintaining offline backups, implementing strict access controls, and ensuring continuous monitoring of their networks to detect unauthorized data exfiltration early in the attack lifecycle.