Evidn listed by Everest ransomware group

• Ransomware group: Everest
• Country: Australia
• Sector: Technology
• Announcement date: January 10, 2025

Everest ransomware group targets Evidn

The ransomware group known as Everest has listed the Australian technology company Evidn on its leak site. The threat actors claim to have successfully exfiltrated 50 GB of data from the organization's systems.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information. The goal is to pressure the victim into paying a ransom by threatening to leak the stolen data on public leak sites. These leak sites serve as a platform for extortion, where groups post names of victims and, in some cases, samples of stolen files to increase the pressure on the targeted company.

Details of the claim

The Everest group listed the organization Evidn on its leak site on January 10, 2025. Along with the listing, the group issued a ransom demand, though the specific amount has not been disclosed. The threat actors stated that company representatives must follow specific instructions to contact them before the specified deadline expires.

The Everest group is identified as a Russian-speaking entity that has been active since 2020. The group is known for various malicious activities, including data theft, extortion, and the sale of unauthorized access to corporate networks. Such groups often target organizations to leverage sensitive data for financial gain, using the threat of public exposure as their primary tool for negotiation.

Data involved in the incident

Regarding the content of the breach, no specific details regarding the nature of the data have been provided by the attackers. The only information released by the group is the claim that the total volume of the stolen data is 50 GB. The listing names no specific data types.

About Evidn

Evidn is an Australian-based company specializing in behavior change and technology solutions. The organization develops digital platforms that combine data analytics and behavioral sciences to address complex social issues.

Risk assessment and implications

This incident may present a risk of exposing sensitive information held by Evidn. As the organization operates in Australia, a potential data breach could trigger legal obligations under the Privacy Act 1988. Organizations operating in highly regulated environments must be prepared for the legal and regulatory scrutiny that follows a confirmed data exfiltration event.

The publication of the alleged data might lead to secondary risks for employees and customers, such as identity theft or targeted phishing campaigns. When stolen data is released publicly, it can be used by other malicious actors to conduct social engineering attacks, using the leaked information to gain trust and further compromise individuals or the organization itself.

Given the known tactics of the Everest group, it is possible that the entirety of the stolen data could be released publicly if the ransom demands are not met. To defend against such threats, organizations typically focus on robust data protection strategies, including implementing strict access controls, maintaining offline backups, and monitoring for unauthorized data exfiltration. Continuous monitoring of network traffic and the implementation of multi-factor authentication are also standard defensive measures used to mitigate the risk of unauthorized access by threat actors.