Everest claims data breach at Collins Aerospace / RTX.com

• Ransomware group: Everest
• Country: United States
• Sector: Manufacturing
• Announcement date: October 17, 2025

Everest claims data breach at Collins Aerospace / RTX.com

The threat actor known as Everest has claimed that data belonging to Collins Aerospace / RTX.com has been leaked. According to the group's announcement on its leak site, the incident is alleged to have occurred on October 17, 2025. This claim marks a new development in the ongoing activities of the Everest group, which has been active since 2020.

Details of the alleged incident

The Everest group has listed Collins Aerospace / RTX.com on its leak site, alleging a significant data breach. In their announcement, the group has shared various links and files regarding the incident. The post associated with this claim includes criticisms of the organization's security processes and makes references to existing media coverage regarding the company.

Ransomware groups often utilize leak sites to apply pressure on their targets through a method known as double extortion. In such scenarios, attackers do not only encrypt an organization's systems but also steal sensitive information, threatening to release it publicly if demands are not met. This tactic is designed to maximize leverage by threatening the target's reputation and legal standing. The presence of a listing on a leak site is a common indicator used by threat intelligence analysts to identify potential compromises, though the claims made by the group remain unconfirmed by the target organization.

Data involved in the claim

Regarding the content of the alleged leak, there is no clear definition of the specific content of the data involved. While the group claims that the data is accessible by sharing download links, the listing names no specific data types.

About Collins Aerospace

Collins Aerospace, a subsidiary of RTX Corporation, is a global manufacturer that develops technological solutions, systems, and components for the aerospace and defense industry. The company provides a wide range of products for commercial, regional, business aviation, and military platforms.

Risk assessment and industry implications

The claims made by the Everest group may pose risks to the organization's operational continuity and data privacy. Depending on the nature of the leaked data, the exposure of sensitive information such as employee records or trade secrets may occur. As a US-based organization, notification obligations under relevant state laws and federal regulations may arise.

Given the group's history of data theft and extortion-focused methods, secondary risks such as targeted phishing attacks or corporate reputation damage may be observed. Furthermore, the actions of this group may also negatively impact supply chain security. In the aerospace and defense manufacturing sector, the security of the supply chain is critical, as a breach in one large organization can potentially create ripples throughout a vast network of partners and contractors.

For organizations operating in high-stakes sectors like aerospace and manufacturing, maintaining robust security posture is essential. Common defensive steps include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movements, and ensuring that all software and hardware components are regularly patched. Additionally, because these groups often target sensitive intellectual property, organizations frequently focus on data loss prevention (DLP) strategies and regular employee training to mitigate the risk of initial access via phishing.

The ongoing activity of groups like Everest highlights the persistent threat posed by specialized ransomware actors. As these groups evolve their methods, organizations must remain vigilant, particularly regarding the potential for secondary attacks that follow a data leak, such as highly targeted social engineering or business email compromise attempts aimed at exploiting the information stolen during the initial breach.