Everest claims data theft from Lamborghini, Ferrari, Fiat Group, VAG, and Brembo

• Ransomware group: Everest
• Sector: Manufacturing
• Announcement date: May 26, 2022

Everest group claims data theft from major automotive manufacturers

On May 26, 2022, a threat actor known as Everest announced that it has obtained data allegedly belonging to several major automotive manufacturers. The group published its claim on a leak site, listing several high-profile organizations to support its assertion of a successful data breach. This announcement marks a significant claim targeting the manufacturing sector, specifically focusing on prominent names within the global automotive industry.

The threat actor involved in this incident is identified as the Everest group. While the group has made these claims, public information regarding the specific identity, infrastructure, or operational history of the Everest group remains limited. This lack of available data is common in the landscape of modern ransomware operations, where threat actors often maintain a low profile to complicate attribution and investigation efforts by security professionals.

Details of the alleged breach

The event involves a claim made by Everest on May 26, 2022. According to the announcement, the group possesses data that is allegedly linked to various major automotive manufacturers. The group explicitly listed the names of several prominent organizations to substantiate their claim of a data leak. However, it is important to note that at the time of the announcement, no screenshots or specific evidence regarding the actual content of the leak were provided by the group.

Regarding the specifics of the incident, the following details are noted:

• The claim was made on May 26, 2022.
• The threat actor is identified as Everest.
• The announcement type is categorized as a data leak.

Despite the gravity of the claim, the group did not provide any information regarding the nature of the allegedly leaked data. There is no information available concerning the specific files, the volume of the data, or the specific systems that may have been compromised. Furthermore, no screenshots were provided to verify the presence of the stolen information on the group's leak site.

The organizations involved in the claim

The Everest group has claimed to have obtained data belonging to a specific list of prominent automotive concerns. The organizations mentioned in the claim include:

• Lamborghini
• Ferrari
• Fiat Group
• VAG
• Brembo

The claim suggests that the breach may impact a wide range of entities within the manufacturing sector, specifically those involved in high-end and mass-market automotive production and components.

Potential implications and industry risks

This claim may pose significant data privacy risks for the involved automotive companies. If the breach is verified, the organizations could face negative impacts regarding their intellectual property and trade secrets. In the highly competitive automotive manufacturing sector, the loss of proprietary designs, manufacturing processes, or strategic business information can result in long-term competitive disadvantages.

Furthermore, if such a breach is confirmed, it is possible that legal processes under the respective countries' data protection regulations may be triggered. Organizations are often required to report such incidents to regulatory bodies to ensure compliance with regional privacy laws. Additionally, there is a risk that the allegedly stolen data could potentially be used in secondary attacks or phishing campaigns, where stolen information is leveraged to gain further access to corporate networks or to deceive employees and customers.

In the broader context of cyber threats, ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not only encrypt a victim's data to demand a ransom for its decryption but also steal sensitive information beforehand. They then threaten to leak this data on public forums or leak sites if the ransom is not paid. This approach increases the pressure on organizations, as the threat of exposing intellectual property or sensitive customer data provides additional leverage for the attackers. To defend against such threats, organizations in the manufacturing sector typically focus on robust data encryption, strict access controls, and continuous monitoring of their network environments to detect unauthorized data exfiltration early in the attack lifecycle.