Everest ransomware group claims data breach at Speed Advisory

• Ransomware group: Everest
• Country: United States
• Sector: Professional Services
• Announcement date: July 26, 2024

Everest ransomware group targets Speed Advisory

The Everest ransomware group has officially listed the professional services firm Speed Advisory on its leak site. According to the threat actor's announcement, the group claims to have successfully exfiltrated a significant volume of data from the organization's systems. This incident highlights the ongoing risks faced by professional service providers by sophisticated cybercriminal groups using extortion tactics.

The claim made by the Everest group involves a substantial amount of information, with the group asserting that they have compromised a total of 150 GB of data. This type of claim is a hallmark of modern ransomware operations, where the focus has shifted from merely encrypting local files to stealing sensitive information to use as leverage in extortion campaigns.

Details of the alleged extortion attempt

The announcement was made on July 26, 2024, coinciding with the date the group claims the attack took place. In the listing, the Everest group issued a direct ultimatum to the organization. The threat actor stated that if Speed Advisory does not contact them within a 24-hour window, the group will proceed to publish all the stolen data on their public leak site.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information to the public or to specific stakeholders. This method increases the pressure on the victim, as the threat of a data leak can cause significant reputational and regulatory damage, regardless of whether the organization can restore its systems from backups.

Sensitive information allegedly compromised

Based on the screenshots provided by the threat actor, the leaked data appears to contain highly sensitive personal and financial information. The nature of the data suggests that the breach could have severe implications for the privacy of the individuals involved. The information identified in the screenshots includes:

• Tax returns
• Social security numbers
• W-2 earnings statements
• Financial records

The presence of such specific documentation, such as U.S. tax returns (Form 1040), social security benefit statements (SSA-1099), and W-2 earnings statements, indicates that the stolen data is of a highly sensitive nature, likely involving the personal identities and financial histories of the organization's clients and potentially its employees.

Organization profile

Speed Advisory is a US-based accounting and tax advisory firm. The organization provides a wide range of professional services, including tax planning, accounting, and financial consulting services, to both individual and corporate clients.

Risk assessment and industry implications

The Everest group is a known threat actor that has been active since 2020. They are recognized for utilizing data exfiltration and extortion tactics to achieve their goals. The alleged exposure of tax and social security information poses a high risk of identity theft for the organization's clients and employees, as these details are primary targets for fraudulent activities.

Because Speed Advisory is based in the United States, this incident may trigger mandatory data breach notification requirements under various state laws and federal regulations. Furthermore, as a provider in the professional services sector, this incident highlights broader concerns regarding supply chain security and third-party risks. When a service provider holds sensitive client data, they become a high-value target, and a breach can have a cascading effect on the security posture of all their clients.

If the data is indeed published, affected individuals may face an increased risk of targeted phishing attacks. In such scenarios, attackers use the stolen personal details to craft highly convincing messages designed to trick victims into revealing even more sensitive information or transferring funds. Organizations in this sector can mitigate such risks by implementing robust data protection measures, maintaining strict access controls, and ensuring comprehensive monitoring of their networks to detect unauthorized data movement.