Everest ransomware group lists Crumbl - Full leak published on its leak site

• Ransomware group: Everest
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: July 31, 2025

Everest ransomware group claims Crumbl data leak

The Everest ransomware group has announced on its leak site that it has published data belonging to the American bakery chain Crumbl. According to the announcement made on the group's platform, the threat actor claims to have compromised the institution's data and subsequently made it publicly available. This claim follows an initial listing of the incident on July 23, 2025, with the full leak being published on July 31, 2025.

Details of the claimed attack

The threat actor known as Everest is utilizing a common ransomware tactic often referred to as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to release this data on a public leak site, the group attempts to pressure the victim into paying a ransom to prevent the exposure of their proprietary or customer information.

In this specific instance, the Everest group alleges that they have successfully breached the organization's defenses and obtained data that is now being hosted on their site. While the group has moved to publish the files, the specific circumstances surrounding the initial entry into the network remain undisclosed in the group's announcement.

Information regarding the leaked data

At this stage, there is no detailed information regarding the specific content of the leaked data. Although the presence of a screenshot indicates that the data has been published, the group has not provided any specific file types or a defined scope for the breach. The listing does not name any specific data types or categories of information that have been compromised.

Potential risks of data exposure

The publication of data can lead to significant consequences for an organization. Such incidents often result in a loss of reputation and can cause lasting damage to customer trust. Furthermore, when an organization is based in the United States, potential data breaches may be subject to various state-level privacy laws and regulations, which may dictate how such incidents must be handled and reported.

About Crumbl

Crumbl is a popular US-based bakery chain specializing in gourmet cookies. The company operates through a wide franchise network and is known for its rotating weekly menu of cookie flavors.

Implications and defensive considerations

This incident suggests that the institution's digital assets and customer information may be at risk. Given the past activities of the Everest group, it is possible that the leaked data could be used for identity theft or targeted phishing attacks. In such cases, attackers use stolen information to craft highly convincing fraudulent communications to deceive individuals.

To address such threats, organizations typically need to conduct thorough forensic investigations to determine the exact scope of the breach and identify which parties may have been affected. General defensive measures for organizations in the retail and e-commerce sectors often include implementing robust multi-factor authentication, maintaining strict access controls, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining comprehensive logging and monitoring can help in the early detection of unauthorized access to sensitive data environments.