K Subsea Group listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Singapore
• Sector: Energy & Utilities
• Announcement date: April 13, 2026

Everest ransomware group claims data breach against K Subsea Group

The Everest ransomware group has listed the Singapore-based energy solutions provider K Subsea Group on its leak site. According to the announcement made on April 13, 2026, the threat actors claim to have successfully exfiltrated data belonging to the organization. The group has initiated a countdown process, a common tactic used by ransomware operators to pressure victims into meeting their demands before the stolen information is released to the public.

The Everest group is identified as a Russian-speaking entity that has been active since 2020. The group is recognized for employing data exfiltration and extortion tactics, often referred to as double extortion. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive information, threatening to publish it on a public leak site if a ransom is not paid. This method increases the pressure on the victim, as the threat of a data leak can cause significant reputational and regulatory damage even if the company can restore its systems from backups.

Claimed data types and technical information

The announcement made by the Everest group claims that the stolen dataset contains a variety of sensitive corporate and technical information. The leaked data is said to include documentation critical to the company's specialized operations and administrative functions. The specific items identified in the claim include:

• Insurance policies
• Equipment inventory records
• Maintenance schedules
• Diving tables
• Emergency plans
• HR disciplinary records
• Equipment serial numbers

The inclusion of such diverse data types, ranging from technical maintenance logs to human resources records, suggests a broad compromise of the organization's internal files.

About K Subsea Group

K Subsea Group is a company based in Singapore that provides integrated subsea solutions to the energy industry. The organization operates both offshore and onshore, maintaining a significant presence across Southeast Asia with over 800 employees.

Impact assessment and industry implications

This breach may lead to the exposure of critical operational and personnel data within K Subsea Group. Due to the company's base of operations in Singapore, the incident could trigger legal processes under the Singapore Personal Data Protection Act (PDPA). The exposure of technical documents, such as equipment serial numbers and maintenance schedules, may weaken the organization's supply chain security, potentially facilitating secondary attacks against the company or its partners.

Furthermore, the exposure of HR disciplinary records increases the risk of identity theft and targeted phishing attacks directed at employees. When personal employee data is leaked, attackers often use it to craft highly convincing social engineering campaigns, making it harder for staff to distinguish between legitimate communications and malicious attempts to gain further access.

Given the historical activities of the Everest group, it is assessed that the stolen data may continue to be used for extortion purposes. Organizations operating in the energy and utilities sector often face high-stakes targeting due to the critical nature of their infrastructure and technical data. To defend against such threats, companies typically implement multi-factor authentication, conduct regular security awareness training, and maintain robust, offline backups to mitigate the impact of encryption-based attacks.