Iberia listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Spain
• Sector: Transportation
• Announcement date: November 25, 2025

Everest claims data breach at Iberia

The ransomware group known as Everest has officially listed the Spanish airline Iberia on its dedicated leak site. According to the group's announcement, the data associated with the organization has been published publicly. This development follows a claim by the threat actors that the organization failed to respond to their specific demands, leading to the decision to release the information.

The group further alleges that the stolen information has not remained confined to their own platform. They claim that the data has been duplicated across various hacker forums and various leak database sites, increasing the potential visibility of the incident. This tactic is common among modern ransomware groups seeking to maximize pressure on their targets through widespread exposure.

Details of the alleged leak

Regarding the specifics of the breach, the information provided by the threat actors remains limited. While the group has published a screenshot, the content of the alleged leak is not explicitly detailed in terms of specific file types or individual records. The available evidence from the screenshot only indicates that a database leak has occurred.

The listing does not provide any specific details regarding the content of the alleged leaked data. Furthermore, no information was provided regarding the total size of the data, the specific file count, or the amount of the ransom demand requested by the group.

About Iberia

Iberia is the flag carrier airline of Spain. The company provides international passenger and cargo transport services and operates as part of the IAG (International Airlines Group).

Analysis and potential impact

The Everest group is assessed as a Russian-speaking actor known for data theft and extortion activities since 2020. This group utilizes double extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release. This approach is designed to increase the likelihood of the organization facing significant operational and reputational damage.

This alleged leak may pose secondary risks to the organization's customers and employees, such as identity theft or targeted phishing attacks. Because the organization is based in Spain, the incident may lead to legal sanctions under GDPR and investigations by data protection authorities. Such regulatory scrutiny often follows significant data exposure events involving personal information.

In the transportation sector, organizations often face complex challenges when dealing with such incidents. To mitigate the risks associated with data theft and extortion, organizations typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging to detect unauthorized access, and ensuring regular, offline backups are maintained. Furthermore, because these groups often target high-profile entities to maximize leverage, continuous monitoring of the dark web and leak sites is a common practice for threat intelligence monitoring.