Sarmap listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Switzerland
• Sector: Technology
• Announcement date: December 2, 2025

Everest ransomware group claims attack on Sarmap

The technology company Sarmap has been listed on the leak site of the Everest ransomware group. According to an announcement made on December 2, 2025, the threat actor claims to have successfully targeted the organization and obtained sensitive information. This listing follows a pattern of double extortion, a common tactic used by modern ransomware groups where attackers not only encrypt systems but also steal data to use as leverage for extortion.

The Everest group claims that the data belonging to Sarmap was obtained and subsequently published on their dedicated leak platform. The threat actor states that the decision to release this information publicly was a direct result of the company's failure to respond within a specified deadline. Furthermore, the group alleges that the stolen data has not been confined to their own platform but has been distributed across various hacker forums and various leak databases to maximize pressure on the victim.

Details of the claimed data breach

Regarding the specific nature of the information involved in this incident, the leak announcement claims that the data consists of a database backup. However, the group has not provided any specific details regarding the exact nature or content of the files. No information was provided regarding the total size of the data or the specific file count involved in the breach.

The listing names no specific data types or individual files that have been compromised.

Implications for the organization

The publication of the alleged data belonging to Sarmap may create significant negative impacts on the company's commercial reputation and its overall operational security. As a Switzerland-based entity, the breach may lead to serious legal consequences under the Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). The exposure of such information often triggers regulatory scrutiny and potential fines from data protection authorities.

The fact that the data may have been shared on public forums increases secondary risks for the organization. These risks include potential identity theft or the execution of targeted phishing attacks aimed at the company's employees and customers. Such secondary attacks often exploit the information leaked during the initial breach to gain further access to corporate networks or to defraud individuals.

Analysis of the threat actor and defensive considerations

It is observed that the Everest group, which has been active since 2020, utilizes data exfiltration and extortion methods to pressure organizations. This method of operation focuses on the threat of public exposure to force a ransom payment. This situation may necessitate a comprehensive re-evaluation of the company's data security processes and incident response plans.

For organizations operating in the technology sector, maintaining robust security postures is essential. Common defensive steps include implementing strict access controls, maintaining offline backups, and conducting regular security audits. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are also critical components of a modern cybersecurity strategy. As ransomware groups continue to evolve their tactics, organizations must remain vigilant against the risks of both encryption-based and exfiltration-based attacks.