Laerdal listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Norway
• Sector: Healthcare
• Announcement date: October 13, 2026

Everest claims data exfiltration against Laerdal

The Everest ransomware group has listed the Norwegian healthcare organization Laerdal on its leak site. According to the group's announcement, they claim to have successfully exfiltrated data from the organization's systems. This development follows a common pattern in modern cyberattacks where threat actors move beyond simple encryption to focus on data theft to increase their leverage.

The group officially listed Laerdal on October 13, 2026. In their announcement, the threat actors stated that the stolen files would be published publicly if contact is not established with them. The group claims to have gained unauthorized access to the organization's internal systems, allowing them to copy and extract specific sets of sensitive information.

Details of the claimed data breach

While the total volume of the data has not been confirmed by the organization, the threat actor has provided specific details regarding the scope of the alleged theft. The group claims to have accessed a significant amount of information, which they intend to use for extortion purposes. The leaked data, according to the group's claims, includes a variety of sensitive administrative and personal records.

The specific categories of data mentioned in the announcement include:

• HR records
• Compensation history
• Candidate information
• Training records
• Organizational reference data
• Access settings
• Support documents

The inclusion of access settings is particularly noteworthy, as such information can provide a roadmap for further unauthorized activity within a network.

About Laerdal

Laerdal Medical is a Norway-based company that develops medical simulation equipment, educational materials, and life-saving devices for healthcare professionals. It provides global solutions, particularly in the fields of emergency medicine and resuscitation training.

Analysis and potential impact

The Everest group is a Russian-speaking threat actor that has been known for engaging in data exfiltration and extortion activities since 2020. This specific breach may lead to the exposure of personal data belonging to Laerdal employees and candidates. Such an exposure could trigger legal consequences under the General Data Protection Regulation (GDPR) due to the sensitive nature of the information involved.

The nature of the data claimed to be stolen could increase the risk of targeted phishing attacks or identity theft against the organization's personnel. Furthermore, the exposure of corporate access settings may create risks for secondary attacks against the organization's digital infrastructure. Given the established history of the Everest group, it is possible that the leaked data could be sold to third parties or used in a broader extortion campaign.

In such scenarios, organizations often face the challenge of double extortion, where attackers threaten to both encrypt systems and leak sensitive data. To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust identity and access management to mitigate the risk of stolen credentials, comprehensive monitoring to detect unauthorized data movement, and rigorous employee training to prevent initial access through phishing. Protecting sensitive HR and training records is a critical component of maintaining organizational integrity and regulatory compliance.