Everest ransomware group claims data breach of ELC Electroconsult SpA

• Ransomware group: Everest
• Country: Italy
• Sector: Technology
• Announcement date: December 16, 2025

Everest ransomware group claims data breach of ELC Electroconsult SpA

The Everest ransomware group has published a claim on its leak site involving ELC Electroconsult SpA. The threat actor group alleges that it has compromised data belonging to the Italian-based firm and has subsequently listed the organization on its dedicated leak site. This announcement, made on December 16, 2025, marks a significant escalation in the group's activities against the organization.

Details of the alleged attack and group claims

According to the claims made by the Everest group, the organization failed to respond to their demands. As a direct consequence of this lack of response, the group states that they have proceeded with the full publication of the stolen data via a public download link. The group further alleges that the compromised information has not remained confined to a single location, but has instead been duplicated across various hacker forums and multiple leak sites.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. By threatening to release this data publicly, the attackers aim to exert maximum pressure on the victim to meet ransom demands. The public release of such data serves to damage the victim's reputation and create legal and operational complications.

The scope of the leaked information

The announcement provided by the Everest group specifies that the stolen information consists of strictly confidential commercial and project-related data. The group claims that the leaked files include various sensitive documents that are critical to the organization's business operations and project management. The specific types of data mentioned in the claim include:

• Technical drawings
• Tender documents (including the Mitsubishi proposal)
• Internal correspondence
• Approval documents (PGE-ELC-JICA)

The presence of such specific documentation, particularly regarding tenders and technical designs, suggests that the breach may target the core intellectual property and operational integrity of the firm's projects.

About ELC Electroconsult SpA

ELC Electroconsult SpA is an Italian-based firm that provides engineering, consulting, and project management services. The company focuses on a variety of sectors, including energy, water, and infrastructure projects. It is noted for its specialization in hydroelectric power plants and various renewable energy projects.

Potential impact and industry implications

This leak may pose significant operational risks due to the exposure of the organization's trade secrets and detailed project information. Because ELC Electroconsult SpA is based in Italy, the presence of any personal data within the leaked files could lead to legal consequences under the General Data Protection Regulation (GDPR). Furthermore, the public release of this data may increase the risk of secondary attacks, such as targeted phishing campaigns, and could negatively impact the organization's supply chain partners who may be connected to these projects.

The Everest group, which has been known to be active since 2020, appears to utilize data theft and extortion tactics to compromise corporate reputation. For organizations operating in the technology and infrastructure sectors, such incidents highlight the necessity of robust data protection strategies. Defensive measures typically include implementing strict access controls, maintaining comprehensive logging to detect unauthorized data exfiltration, and conducting regular audits of sensitive project documentation. Protecting the integrity of the supply chain is also vital, as a breach in one partner can create cascading risks for all associated stakeholders.