Notin listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Spain
• Sector: Technology
• Announcement date: December 23, 2025

Everest ransomware group targets Notin

The Everest ransomware group has listed the Spanish technology provider Notin on its dedicated leak site. According to the announcement, which appeared on December 23, 2025, the threat actors claim to have successfully executed a data security incident targeting the organization. The group alleges that they have gained unauthorized access to the organization's systems or have obtained data directly from its infrastructure.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data on public platforms, the threat actors aim to coerce the organization into paying a ransom to prevent the exposure of confidential information. This method increases the psychological and reputational pressure on the target, as the threat of public disclosure can lead to significant legal and commercial consequences.

Claims of the attack

The announcement made by the Everest group on December 23, 2025, serves as a claim of a successful breach. The group asserts that they have compromised the systems of Notin, a prominent technology provider. While the group has officially listed the organization on their platform, the specific details regarding the method of entry or the exact nature of the intrusion have not been disclosed in the initial announcement.

The group has been active since 2020, and their involvement in such incidents often carries secondary risks. Beyond the initial breach, groups with this history may engage in the sale of network access to other cybercriminals or proceed with direct ransom demands. The presence of an organization on a leak site is a significant indicator of a potential security compromise that requires immediate investigation by the affected party.

Details regarding the alleged data leak

At this stage, the specific nature and scope of the allegedly leaked data remain unspecified. Because the provided documentation failed to load content, the exact types or the volume of the data involved cannot be verified. The listing names no specific data types or file counts.

In many ransomware incidents, the lack of immediate clarity regarding the stolen data is a common challenge for incident responders. Without a confirmed inventory of the exfiltrated information, it is difficult to determine the exact impact on the organization's privacy obligations. Organizations typically respond to such uncertainty by conducting deep forensic analysis to identify which databases, file servers, or communication channels were accessed by the threat actors.

Organization profile: Notin

Notin is a leading comprehensive technology provider for notaries in Spain. The company offers a wide range of services designed to support notarial processes, including management software (ERP), hardware, maintenance, cybersecurity, and artificial intelligence services.

Potential impact and industry implications

Given the past activities of the Everest group, it is possible that the organization's sensitive commercial data or client information may be at risk. Because Notin provides essential software and hardware support to notary services, a potential data breach could lead to a supply chain impact on third parties. When a technology provider serving a critical sector is compromised, the breach can ripple through the entire ecosystem of their clients.

Furthermore, such an incident may result in legal and administrative sanctions under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must adhere to strict protocols regarding the protection of personal data and the timely reporting of breaches. Additionally, the group's methods of data theft and extortion may negatively affect the organization's operational continuity and reputation.

To mitigate these risks, organizations in the technology and service provider sectors often implement defensive strategies such as multi-factor authentication, network segmentation, and continuous monitoring of their infrastructure. Maintaining robust backup solutions and conducting regular vulnerability assessments are also standard practices to defend against the evolving tactics used by ransomware groups like Everest.