Linebarger Goggan Blair & Sampson listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: United States
• Sector: Professional Services
• Announcement date: October 22, 2026

The Everest ransomware group has listed the United States-based law firm Linebarger Goggan Blair & Sampson on its leak site. This announcement, appearing in the chronicle section of the group's platform, marks a new claim of a data breach involving the professional services firm.

Details of the claim

According to the listing posted on October 22, 2026, Everest has targeted Linebarger Goggan Blair & Sampson. The information provided by the threat actor is currently limited due to the nature of the evidence presented. A screenshot associated with the claim shows the firm's name at the top of a list on the left-hand side of the interface. On the right-hand panel, a countdown timer was visible, indicating approximately seven days and seventeen hours remaining before the next phase of the attack.

The text within the leak site panel states that the files will be published once the countdown timer reaches zero. Furthermore, the group has indicated that the company still has time to get in touch with them. At this stage, the claim remains a listing claim, and there is no verifiable information regarding the authenticity of the data or the specific details of the breach.

Data involvement and visibility

The current visibility of the leaked information is extremely limited. Due to the presentation of the evidence, the screenshot provided by the threat actor is heavily blurred. This prevents any clear reading of the specific details regarding the listing or the content of the alleged breach.

Regarding the specifics of the breach, the following observations can be made:

• No legible information is provided regarding the specific types of data that were allegedly taken.
• The listing does not specify the total size of the data.
• The total file count remains unknown.
• No sample content has been provided to verify the claims.

The panel only confirms that the files will be published once the countdown period concludes.

Organization profile

Linebarger Goggan Blair & Sampson is an American law firm that specializes in tax collection and various related legal services for government entities. The firm focuses primarily on managing delinquent tax receivables on behalf of local governments and school districts.

Analysis and industry implications

This incident is currently categorized as a listing claim, meaning there is no verifiable information regarding the type, size, or authenticity of the data involved. The heavy blurring of the screenshot prevents a technical assessment of the contents. However, the potential impact of such a breach in the professional services sector, particularly for a law firm, can be significant. A firm of this nature may hold sensitive personal and financial information regarding both clients and debtors.

If the claims made by Everest are accurate, the impact of the breach could extend far beyond the law firm itself. Such an event could trigger various legal and regulatory consequences, including breach notification duties and the fulfillment of client confidentiality obligations. The severity of the situation can only be fully assessed once the firm responds to the threat or once the content of the data becomes clear to investigators.

Everest is identified as a Russian-speaking group that has been active since 2020. The group's primary focus involves data theft and extortion. In such scenarios, ransomware groups often employ double extortion tactics, where they not only encrypt an organization's data but also threaten to leak sensitive information on public sites to pressure the victim into paying a ransom.

For organizations operating in the professional services and legal sectors, maintaining robust cybersecurity postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access via phishing or other common vectors.