Rezayat Group listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Saudi Arabia
• Sector: Manufacturing
• Announcement date: July 13, 2025

The ransomware group known as Everest has listed Rezayat Group on its leak site, claiming to have compromised the organization's data. This announcement, made on July 13, 2025, follows the group's claim of having gained unauthorized access to the organization's systems on July 8, 2025.

The claimed attack and extortion activities

According to the announcement posted on the Everest leak platform, the group claims to have successfully performed a data exfiltration after gaining unauthorized access to the systems of Rezayat Group. This listing is presented as part of the group's ongoing extortion activities, which typically involve a double extortion model. In such scenarios, threat actors not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations.

The group's tactics focus on data theft and extortion, a method designed to maximize pressure on the victim. By threatening to publish or sell stolen data, attackers aim to force organizations into compliance. While public information regarding the specific operations and methods of the Everest group remains limited, the listing confirms their intent to utilize the stolen information for further extortion purposes.

Details regarding the compromised data

At this stage of the incident, no specific details or sample files regarding the nature of the compromised data have been provided by the threat actors. The listing does not specify the volume of data stolen or the exact types of files involved in the breach.

• No specific data types have been identified in the listing.

About Rezayat Group

Rezayat Group is a Saudi Arabia-based multinational conglomerate. Since its founding in 1949, the group has operated across various sectors and provides a wide range of services across the Middle East. Its business operations include construction, engineering, logistics, manufacturing, and trading.

Potential impact and organizational risks

Given the past activities of the Everest group, this incident may lead to operational disruptions and reputational damage for the organization. The group's focus on data theft and extortion suggests a potential for further publication or sale of the data, which can exacerbate the impact on the victimized entity.

Depending on the nature of the exfiltrated data, the exposure of employee or customer information could result in secondary risks such as identity theft and targeted phishing attacks. Furthermore, the organization may face legal obligations under Saudi Arabian data protection regulations resulting from the breach.

In the manufacturing and logistics sectors, such incidents often necessitate robust incident response plans. Organizations in these sectors typically focus on strengthening network segmentation, implementing strict access controls, and maintaining comprehensive monitoring to detect unauthorized access early. Defensive strategies often include regular security awareness training to prevent initial access and maintaining offline, immutable backups to mitigate the impact of encryption-based ransomware.