Everest ransomware group claims data breach at ETS

• Ransomware group: Everest
• Country: United States
• Sector: Education
• Announcement date: September 25, 2026

The threat actor known as Everest has published a ransom announcement on its leak site, claiming to have exfiltrated data from the Educational Testing Service (ETS). This development marks a significant incident involving a major entity within the education sector, as the group has listed the organization on its platform to pressure them into meeting specific demands.

Details of the claimed attack

According to the announcement posted on September 25, 2026, the Everest group has officially listed ETS on their dedicated leak site. The group has initiated a countdown process, a common tactic used in modern ransomware operations to create psychological pressure on the victim organization. This countdown is intended to force the institution to establish contact with the attackers within a specific timeframe.

The group has indicated that a particular window of time has been provided to the institution to prevent the public release of the stolen information. This approach is characteristic of double extortion tactics, where attackers not only encrypt an organization's systems but also threaten to leak sensitive information to the public or its stakeholders if the ransom is not paid. By setting a deadline, the threat actors attempt to accelerate the decision-making process of the targeted organization.

Alleged exfiltrated data

Based on screenshots provided by the threat group, the data allegedly stolen during the breach is highly sensitive and relates directly to the core functions of the organization. The information reportedly includes various types of educational and administrative records. The specific categories of data identified in the claim include:

• Student registration information
• Test results
• Operational education data
• Assessment materials

The exposure of such diverse datasets, ranging from personal registration details to proprietary assessment materials, suggests a broad compromise of the organization's digital environment. While the specific volume and exact count of files have not been disclosed by the group, the nature of the categories mentioned points toward a significant breach of institutional and personal information.

About Educational Testing Service

The Educational Testing Service (ETS) is a non-profit organization that provides educational assessment, measurement, and research services. It is a globally recognized entity responsible for the development and administration of high-stakes exams, including the TOEFL and GRE. Because of its role in managing standardized testing and academic assessments, the organization handles a vast amount of sensitive data related to students and educational processes worldwide.

Impact and industry implications

This incident highlights the ongoing risks faced by institutions within the education sector regarding the protection of sensitive data. The alleged exfiltration of student data introduces several secondary risks, most notably the potential for identity theft and the execution of highly targeted phishing attacks against students and academic professionals. When personal identifiers are compromised, they can be used by various malicious actors for fraudulent activities.

Given the established history of the Everest group—a Russian-speaking entity active since 2020 that utilizes data theft and extortion—the institution may face significant operational disruptions. Furthermore, such a breach can lead to potential legal sanctions and substantial reputational damage, resulting in a loss of trust among students, educators, and other key stakeholders. The exposure of assessment materials could also compromise the integrity of educational standards managed by the organization.

For organizations operating in the education sector, this incident underscores the necessity of robust data protection frameworks. To mitigate the risks of such attacks, institutions typically focus on strengthening their defensive postures through enhanced monitoring, strict access controls, and comprehensive incident response plans. Protecting the integrity of assessment materials and the privacy of student records remains a critical priority for maintaining stakeholder confidence in the digital age.