Grupo DT listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Spain
• Announcement date: August 20, 2026

The Everest ransomware group has officially listed the Spanish organization Grupo DT on its dedicated leak site. Through this announcement, the threat actor group has claimed to have compromised sensitive information belonging to the company and is currently threatening to publish the stolen data if their demands are not met.

The claimed ransomware incident

The incident involving Grupo DT was announced by the Everest group on August 20, 2026. By listing the organization on their leak site, the group has initiated a countdown process, a tactic commonly used by ransomware operators to exert psychological pressure on their victims. This countdown serves as a deadline for the organization to communicate with the attackers.

The group has stated that the data may be published if the organization fails to meet their requirements. This method is a hallmark of modern double extortion tactics, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage for further extortion. By threatening public disclosure, the group aims to maximize the pressure on the victim to comply with their demands.

Alleged compromised data

According to the information provided in the leak, the data allegedly compromised includes a variety of sensitive documents and technical files. The specific types of information claimed to be stolen include:

• Vehicle inspection reports
• Ownership transfer documents
• Valuation reports
• Dealer and agency contracts
• Various server backups

The presence of server backups in the alleged leak is particularly significant, as these files often contain vast amounts of historical data and internal configurations that can be used to further understand the target's infrastructure.

About Grupo DT

Grupo DT is a construction and real estate development company based in Spain. The organization operates across several key sectors within the industry, including residential projects, commercial structures, and urban development.

Impact and implications of the breach

The actions taken by the Everest group could have significant consequences for Grupo DT. Such an incident may negatively impact the organization's operational continuity and its commercial reputation. Furthermore, because the organization operates within Spain, this breach may trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR).

The nature of the data allegedly stolen—which includes ownership documents and contracts—could increase the risk that third parties, such as clients or business partners, may be exposed to identity theft or targeted phishing attacks. The group has been known for its data theft and extortion methods since 2020, and the potential publication of this data could lead to secondary extortion attempts.

Additionally, the organization's supply chain partners may be indirectly affected by this situation. In modern digital ecosystems, a breach in one company often creates ripple effects throughout its network of contractors and collaborators. To mitigate such risks, organizations typically focus on robust backup strategies, strict access controls, and comprehensive employee training to defend against the evolving landscape of ransomware and extortion-based cyber threats.