Frost Bank listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: United States
• Sector: Financial Services
• Announcement date: April 20, 2026

The Everest ransomware group has listed Frost Bank on its leak site, claiming to have obtained sensitive data belonging to the institution. This announcement, made on April 20, 2026, marks a significant escalation in the threat actor's campaign against the financial services provider.

The claims of the Everest ransomware group

The threat actor known as Everest published an announcement on April 20, 2026, regarding Frost Bank. According to the group's claims, the institution is facing a critical deadline. The group has stated that if the institution does not establish contact with them, the allegedly stolen data will be released publicly.

To increase the pressure on the target, the post includes a countdown timer. This mechanism is a common tactic used by ransomware groups to create a sense of urgency, attempting to force the victim into a quick decision regarding the ransom demand. While the specific ransom demand has not been disclosed in the announcement, the presence of a deadline indicates a high-pressure extortion attempt.

Alleged data types involved in the breach

The threat actor has provided evidence of the breach through screenshots of various documents. These samples suggest that the compromised data contains highly sensitive financial and tax-related information. Based on the provided imagery, the following types of data are allegedly involved in the leak:

• HSA contribution data
• Dividend income information
• Miscellaneous income information
• Secured property information
• Debt cancellation records
• ACA reporting data

The nature of these documents, which include forms such as 5498-SA, 1099-DIV, 1099-MISC, 1099-A, 1099-C, and 1094K, highlights the potentially severe impact of this alleged exfiltration.

About Frost Bank

Frost Bank is a well-established banking and financial services institution operating in the state of Texas, USA. It provides a wide range of services, including personal and commercial banking, investment, and insurance services to its clientele.

Analysis and implications for the financial sector

The allegedly compromised data may contain sensitive financial and tax information, which could pose a significant risk of identity theft and fraud for both the institution and its customers. For a financial institution, the exposure of such data is a critical event that can lead to long-term reputational damage and loss of customer trust.

As a US-based financial institution, the incident may have legal implications under the Gramm-Leach-Bliley Act (GLBA) and relevant state regulations. Such frameworks are designed to ensure that financial institutions protect the privacy of consumer information and are subject to strict rules regarding data security and breach notification.

Given that the Everest group is known for data exfiltration and extortion, this situation may lead to secondary extortion attempts or the sale of data to third parties. This is a hallmark of modern double extortion ransomware attacks, where attackers not only encrypt systems but also steal data to use as leverage during negotiations.

In such scenarios, organizations are often required to fulfill data breach notification obligations and inform affected customers to mitigate potential harm. Defensive strategies for organizations in the financial sector typically involve robust encryption of data at rest and in transit, strict access controls, continuous monitoring for unauthorized data movement, and comprehensive incident response plans to manage the fallout of a potential breach.