Petrobras Campos Basin seismic survey data claimed by Everest ransomware group

• Ransomware group: Everest
• Country: Brazil
• Sector: Energy & Utilities
• Announcement date: November 17, 2025

Everest ransomware group claims theft of Petrobras seismic survey data

The Everest ransomware group has published a listing on its leak site claiming to have obtained sensitive seismic survey data belonging to Petrobras. According to the announcement made on November 17, 2025, the threat actor alleges that the stolen information pertains to the Campos Basin. This claim follows a pattern of double extortion, a common tactic used by modern ransomware groups where data is not only encrypted but also exfiltrated to be used as leverage during negotiations.

In these types of cyberattacks, threat actors typically target high-value information to increase their bargaining power. By threatening to release sensitive corporate data on public forums, these groups aim to pressure organizations into paying a ransom. The presence of a leak site listing serves as a public notification of the breach, often used to damage the reputation of the victim or to prove the validity of the theft to the target organization.

Details of the alleged breach and claims

The threat actor known as Everest has posted a specific listing under the title "Petrobras Campos Basin 3D & 4D Seismic Survey Data." In the announcement, the group alleges that it has already published the institution's data and asserts that these files have been distributed across various forums. The post reportedly provides external links for data download, a common method used by ransomware groups to facilitate the spread of stolen information.

Furthermore, the group claims that the institution has failed to respond to their ransom demands. While the group has provided screenshots to support their claims, there is no detailed breakdown regarding the full scope or the specific content of the leaked data. No information was provided regarding the total size of the data, the specific file count, or the exact amount of the ransom demand requested by the group.

Affected data types

• Seismic survey data

About Petrobras

Petrobras is a Brazilian state-owned multinational petroleum and gas corporation. The company operates in the exploration, production, refining, and distribution of oil and natural gas.

Potential impact and industry implications

The Everest group is known as an entity operating since 2020, utilizing data exfiltration and extortion methods. This incident may lead to the exposure of the institution's trade secrets and strategic operational data. For an institution operating in the energy sector, the leakage of such data could result in the loss of competitive advantage and potential long-term operational risks.

The exposure of strategic data in the energy sector is particularly sensitive due to the high value of geological and exploration information. Beyond the immediate loss of intellectual property, such breaches can lead to secondary risks. For instance, the leaked data could be utilized by other threat actors for targeted phishing campaigns or as a foundation for corporate espionage activities. Such activities can further compromise the security posture of the organization and its partners.

From a regulatory perspective, the institution may face mandatory data breach notification requirements under Brazilian data protection regulations (LGPD). Organizations facing similar threats often focus on strengthening their defensive measures, such as implementing robust data loss prevention (DLP) tools, enhancing network monitoring, and conducting regular security awareness training to mitigate the risk of initial access by threat actors.