RansomHub ransomware group lists everde.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: December 1, 2024

RansomHub claims to have leaked Everde Growers data

The RansomHub ransomware group has officially listed data allegedly belonging to Everde.com on their dedicated leak site. This announcement, made on December 1, 2024, suggests a significant breach involving the sensitive information of the organization and its workforce. While the group has claimed responsibility for the leak, the incident highlights the ongoing threat posed by ransomware-as-a-service (RaaS) operations targeting various industrial sectors.

The event involves a claim of data exfiltration rather than a simple encryption attack. In such scenarios, threat actors typically employ double-extortion tactics, where they not only encrypt the victim's systems but also steal sensitive information to use as leverage. By threatening to publish this data on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of confidential records.

RansomHub is recognized as a RaaS group that emerged in early 2024. The group reportedly gained prominence after absorbing various affiliates following the incident involving the ALPHV group. While the group's activities were reported to have ceased in early 2025, this specific incident involving Everde.com occurred in late 2024.

Details of the alleged data leak

According to the information provided by the RansomHub group, the leaked data includes various documents that are claimed to be related to the operational processes of the organization. The group has shared screenshots to support their claims, which purportedly contain highly sensitive internal documentation.

The specific types of data mentioned in the leak include:

• Employee HR data
• Payroll records
• Medical records
• Social security numbers

The presence of such diverse documentation suggests that the attackers gained access to both administrative and human resources systems. The inclusion of personal identifiers and financial records significantly increases the severity of the breach for the individuals involved.

About Everde Growers

Everde Growers is a large-scale agricultural company based in the United States. The organization specializes in the cultivation of ornamental plants and nursery stock. Their production capabilities allow them to supply a wide range of plants to both the landscape and retail sectors, making them a significant player in the American agricultural industry.

Risk assessment and industry implications

The allegedly leaked data poses a high risk to the organization and its employees. Because the information includes sensitive personal and financial details, such as social security numbers and payroll records, there is a heightened risk of identity theft. Furthermore, the exposure of employee information often leads to targeted phishing attacks, where malicious actors use the stolen data to craft highly convincing social engineering messages to deceive employees or other business partners.

For a US-based organization, this situation may lead to significant legal and regulatory scrutiny. The company may face potential liabilities under various state-level data privacy regulations that govern how personal information must be protected and how breaches must be reported. Additionally, the use of double-extortion tactics by groups like RansomHub can cause lasting damage to an organization's reputation and overall operational security.

Beyond the immediate impact on the company, the sensitivity of the shared documents may create indirect risks for supply chain partners. In the agriculture and food production sector, interconnected business relationships mean that a breach in one company can potentially expose vulnerabilities or sensitive information related to the broader supply chain. Organizations in this sector can mitigate such risks by implementing robust data encryption, maintaining strict access controls, and conducting regular security audits to protect both their operational integrity and the privacy of their workforce.