Everest ransomware group lists Atlas Air: MUSE INSECURE on its leak site

• Ransomware group: Everest
• Country: United States
• Sector: Transportation
• Announcement date: February 17, 2026

Everest ransomware group claims attack on Atlas Air

The ransomware group known as Everest has officially listed Atlas Air on its dedicated leak site. This announcement, which occurred on February 17, 2026, marks a new development in the group's ongoing series of cyberattacks. According to the claim made by the threat actors, the group has successfully gained access to the data belonging to the organization.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By publicly listing an organization, these groups aim to damage the victim's reputation and force them into paying a ransom to prevent the release of sensitive information. This tactic is a hallmark of modern cyber extortion, where the threat of data exposure becomes a powerful lever in negotiations.

Details of the claimed incident

The incident was announced on February 17, 2026, with the group claiming that the attack took place on the same day. While the group has published a listing, the available evidence remains limited. The screenshot provided by the group's interface shows a loading icon and an empty content area, suggesting that the specific details of the breach are not yet visible on their platform.

Regarding the specifics of the breach, there is no information available regarding the nature of the leaked data. The listing currently names no specific data types or categories of information that may have been compromised. Furthermore, there is no information available regarding the size of the data or the total file count involved in the alleged breach. The group has also not issued a specific ransom demand at this time.

Potential risks and implications

The Everest group has been active in the cybercrime landscape since 2020, known for engaging in various data theft and extortion activities. Because of this history, the current claim poses significant risks to the operational continuity of the targeted organization. When a group with a proven track record of extortion targets a company, the potential for a double extortion attempt increases.

Double extortion is a sophisticated tactic where attackers not only encrypt a company's systems to disrupt operations but also steal sensitive data to use as leverage. If the victim refuses to pay the ransom to decrypt their systems, the attackers threaten to leak the stolen data publicly. This creates a dual crisis for the organization: a technical recovery challenge and a massive data privacy crisis.

Regulatory and secondary risks

As the organization is based in the United States, any potential data breach may be subject to complex legal frameworks, including state-level privacy laws and various sectoral regulations. These regulations often mandate strict reporting requirements and specific protocols for notifying affected parties in the event of a confirmed breach.

Beyond the immediate regulatory concerns, the publication of organizational data can lead to severe secondary risks. If sensitive information is leaked, it can facilitate identity theft for employees or customers. Such incidents can lead to long-term damage to the trust between the organization and its stakeholders. Organizations in the transportation sector typically manage vast amounts of logistical and personal data, making them high-value targets for such activities.

To mitigate these risks, organizations often implement defensive strategies such as robust backup solutions, multi-factor authentication, and continuous monitoring of network traffic. However, when a group like Everest makes a public claim, the focus often shifts toward incident response and legal compliance to manage the fallout of the potential exposure.