Everest ransomware group claims data breach against Colins Aerospace

• Ransomware group: Everest
• Country: United States
• Sector: Manufacturing
• Announcement date: October 17, 2025

Everest ransomware group targets Colins Aerospace

The ransomware group known as Everest has listed Colins Aerospace / RTX.com on its leak site, alleging that the organization has suffered a data breach. This announcement, which appeared on the group's platform, marks a significant claim against the major manufacturing entity.

Details of the alleged security failure

According to the claim made by the Everest group, the organization experienced a security failure. This event was officially announced on the group's leak platform on October 17, 2025. As of the current observation, the announcement remains displayed as an active entry on the group's leak site, indicating that the threat actor is still maintaining the claim publicly.

Information regarding the compromised data

At this stage, the specific nature or the scope of the allegedly compromised data has not been disclosed by the threat actors. The information provided by the group is limited to the organization's name and the general allegation of a security failure. The listing does not name any specific data types or categories of information that have been targeted or stolen.

Summary of affected data

• No specific data types were named in the listing.

About Colins Aerospace

Colins Aerospace, a subsidiary of RTX Corporation, is a global manufacturer that develops technological solutions, systems, and components for the aerospace and defense industry. The company specializes in aircraft systems, avionics, interiors, and mission systems.

Risk assessment and industry implications

This claim by the Everest group suggests that the organization's operational data or intellectual property may be at risk. As a US-based manufacturing entity, a potential data breach could lead to challenges regarding compliance with sectoral regulations and state-level data protection laws. Given the group's history, there is a possibility that the allegedly stolen data could be used for extortion or sold to third parties.

Furthermore, such an incident may create secondary risks for the organization's supply chain and could potentially facilitate targeted phishing attacks. In the context of modern cyber threats, ransomware groups often employ double extortion tactics, where they not only encrypt an organization's systems but also threaten to leak sensitive information to pressure the victim into paying a ransom. This approach increases the pressure on organizations to comply with demands to avoid reputational damage or legal consequences.

For organizations operating within the manufacturing and aerospace sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Common defensive steps for organizations facing these types of threats include maintaining rigorous patch management, implementing multi-factor authentication across all access points, and conducting regular security audits. Additionally, strengthening supply chain security is essential to prevent secondary risks that could impact partners and clients. Information regarding this specific group remains limited.