ITSS targeted by Everest ransomware group in alleged data breach

• Ransomware group: Everest
• Country: Switzerland
• Sector: Technology
• Announcement date: February 4, 2025

Everest ransomware group claims data theft from ITSS

The Everest ransomware group has announced a data breach involving the Swiss-based technology firm ITSS. According to an announcement made on a ransomware leak site on February 4, 2025, the threat actors claim to have successfully exfiltrated a significant volume of data belonging to the organization. The group alleges that the attack took place on the same day the announcement was posted, February 4, 2025.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on public forums, these groups aim to increase the pressure on organizations to pay a ransom. In this instance, the Everest group has moved to the public leak stage, claiming they have gained unauthorized access to the internal network of ITSS.

Details of the alleged exfiltration

The Everest group alleges that they have gained access to the internal network of ITSS and subsequently exfiltrated 173 GB of data. The threat actors have issued a demand for company representatives to contact them within a specific timeframe to resolve the matter. While the group has made these claims, no specific ransom demand has been disclosed in the public announcement.

The content of the alleged breach is described as being quite substantial in terms of volume. The group states that the stolen information consists of 173 GB of internal files. According to the claims made by the threat actors, the exfiltrated data includes various sensitive categories, such as:

• Banking information
• Contract data
• Internal network documents

The group further specifies that the data includes various technical directory structures alongside the banking and contract documents. The presence of such technical information can often provide attackers with a roadmap of an organization's internal infrastructure, potentially facilitating further malicious activity.

About ITSS

ITSS is an international technology company that specializes in providing digital transformation, software solutions, and IT consulting services. The company focuses its operations on the banking and financial sector. ITSS is headquartered in Geneva, Switzerland.

Potential impact and industry considerations

The nature of the data allegedly stolen in this incident carries significant risks. The inclusion of banking information and contract details suggests that the breach could potentially lead to risks such as identity theft or fraud for both the organization and its various clients. Because ITSS is based in Switzerland, the incident may lead to legal consequences under the General Data Protection Regulation (GDPR) and other local data protection regulations.

Given the historical activities associated with the Everest group, it is possible that the stolen data could be used for extortion purposes or could eventually be sold to third parties on the dark web. When an organization faces a breach of this nature, it is common practice to conduct a comprehensive forensic investigation to determine the full scope of the breach and to identify exactly what was accessed or stolen.

For organizations operating within the technology and financial services sectors, maintaining robust security postures is critical. This typically involves implementing multi-factor authentication, maintaining strict network segmentation, and ensuring that all software and systems are regularly patched. Furthermore, notifying relevant authorities is a standard requirement when sensitive data is compromised. Organizations must be prepared to manage the legal, regulatory, and reputational fallout that follows such an event.