Everest ransomware group claims data breach at PT Brantas Abipraya

• Ransomware group: Everest
• Country: Indonesia
• Sector: Manufacturing
• Announcement date: March 31, 2026

The Everest ransomware group has published a notice on its dedicated leak site, claiming to have stolen data belonging to the Indonesian organization PT Brantas Abipraya. This announcement, made on March 31, 2026, suggests a significant breach involving both corporate and personal information.

The alleged incident

According to the claims made by the Everest group, the cyberattack occurred on March 31, 2026. The threat actors assert that they have successfully exfiltrated a wide range of sensitive information from the target organization. This data is described as encompassing operational, financial, and personnel-related records, which the group has made publicly available on their platform.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to threaten the victim with public exposure. By publishing stolen files, the attackers aim to increase pressure on the organization to meet ransom demands. While the specific details regarding the ransom demand and the exact volume of data have not been provided by the group, the claim of a data leak has already been officially announced on their platform.

The claimed stolen data

The Everest group alleges that the stolen information includes a diverse array of documents that could impact both the company's internal operations and the privacy of its individuals. The information claimed to be leaked includes the following:

• National ID information
• Tax numbers (NPWP)
• Home addresses
• Occupational health and safety certificates
• Competency certificates (SKK)
• Personal archive files
• Financial reports
• Budget plans
• Invoices
• Corporate meeting recordings

The presence of such a wide variety of documents, ranging from highly personal identification details to strategic corporate recordings, suggests a deep level of access into the organization's digital environment.

About PT Brantas Abipraya

PT Brantas Abipraya is an Indonesian state-owned construction company. The organization specializes in large-scale infrastructure projects, including the development of dams, bridges, roads, and power plants. Its primary areas of operation are focused on civil engineering and water resources management.

Risk assessment and organizational implications

This alleged leak poses a high risk of identity theft and fraud for the employees and stakeholders of PT Brantas Abipraya. The sensitive nature of the claimed data, particularly national IDs and tax numbers, places the organization in a position where it may face legal obligations under Indonesian data protection regulations. Furthermore, the exposure of strategic documents and corporate meeting recordings could lead to significant damage to the organization's commercial reputation and create a strategic disadvantage when competing against other firms.

The past activities of the Everest group indicate that stolen data can be used for extortion or may serve as a stepping stone for secondary attacks against the organization or its partners. When faced with such incidents, organizations typically need to notify the affected individuals and initiate a comprehensive forensic investigation to determine the true scope and impact of the breach.

In the manufacturing and infrastructure sectors, maintaining data integrity and confidentiality is critical for operational security and public trust. Defensive measures often involve implementing robust access controls, continuous monitoring of network traffic, and ensuring that sensitive administrative and financial files are encrypted and isolated from general access. A thorough investigation is essential to identify the entry point and prevent future unauthorized access.