Everest ransomware group lists Sarmap - Database leaked on its leak site

• Ransomware group: Everest
• Country: Switzerland
• Sector: Agriculture and Food Production
• Announcement date: December 8, 2025

Everest claims database leak at Sarmap

The ransomware group known as Everest has issued a new announcement on its leak site, claiming to have successfully breached the organization Sarmap. According to the group's claim, they have gained unauthorized access to the organization's database and have subsequently shared the relevant data on their dedicated leak platform.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data, these groups aim to pressure victims into paying a ransom to prevent the public exposure of their proprietary or personal information. This tactic significantly increases the pressure on an organization, as the damage from a data leak can persist long after a technical recovery is complete.

Details of the claimed breach

The announcement made by Everest on December 8, 2025, focuses on the theft of a database. While the group has posted the claim on their leak site, they have not provided any specific details regarding the exact content or the nature of the files contained within the leaked database. Furthermore, the group has not disclosed information regarding the total size of the data or the specific number of files involved in the incident.

The listing names no specific data types that were allegedly stolen during the attack.

Potential impact and risks

The claim made against Sarmap carries significant implications for the organization's future operations. Such an incident can negatively impact the organization's operational continuity and its commercial reputation. In the modern digital landscape, the loss of data integrity and confidentiality can undermine the trust that clients and partners place in a company, potentially leading to long-term commercial consequences.

Because Sarmap is an organization based in Switzerland, a confirmed breach could trigger specific legal obligations under the Federal Act on Data Protection (FADP). Regulatory frameworks like the FADP are designed to ensure that organizations handle personal data with high standards of security and accountability, and a breach often necessitates formal reporting and compliance procedures to mitigate legal risks.

Secondary risks and group profile

Given the past activities of the Everest group, there is a heightened risk that the leaked data could be utilized for malicious purposes such as identity theft or corporate espionage. The group's established practice of sharing data across various platforms can increase secondary risks, potentially leading to the permanent exposure of the information. Once data is published on the dark web or various leak sites, it becomes difficult to fully erase, creating a lasting vulnerability for the targeted entity.

Information regarding the Everest group remains limited, making it difficult to predict their specific long-term objectives beyond their typical extortion patterns. Organizations facing such threats generally focus on robust defensive measures, including implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to detect unauthorized access to databases before data can be exfiltrated.

Organizational context

Sarmap operates within the agriculture and food production sector. This sector is increasingly targeted by cybercriminals due to the critical nature of its supply chains and the sensitive commercial data involved in food production and distribution processes. Protecting the integrity of databases in this sector is vital for maintaining the stability of food supply chains and ensuring that proprietary production methods remain secure.