Securitas Group listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Sweden
• Sector: Professional Services
• Announcement date: September 25, 2026

The Everest ransomware group has listed Securitas Group on their leak site, alleging the acquisition of the organization's data. This announcement, made on September 25, 2026, marks a significant development in the ongoing targeting of large-scale professional services providers by sophisticated threat actors.

The alleged attack and claims by Everest

According to the announcement posted on the group's leak platform, the Everest group claims to have gained unauthorized access to the data of Securitas Group. The threat actor's listing suggests that the group is employing a strategy designed to exert maximum pressure on the organization. By claiming possession of sensitive information, these groups often attempt to coerce victims into meeting specific demands through the potential publication or sale of the stolen data on public or dark web forums.

This tactic is a hallmark of modern ransomware operations, often referred to as double extortion. In such scenarios, the attackers do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive information. The threat of leaking this data serves as a secondary lever to ensure the victim complies with ransom demands, even if the organization has robust backups to restore their systems.

Details regarding the alleged leaked data

At this stage, the information provided by the threat actor remains extremely limited. No screenshots or detailed information regarding the nature of the alleged leaked data have been provided by the Everest group. Furthermore, the listing does not specify the volume of data involved or the specific file count. The listing names no data types.

Potential risks of data exposure

While the specific contents of the breach remain unconfirmed and undisclosed by the attackers, the potential implications of such an incident are significant. If the compromised data includes sensitive information, it could lead to various secondary risks for the organization and its stakeholders.

• Identity theft: The exposure of personal information can facilitate identity theft.
• Targeted phishing: Compromised data can be used to craft highly convincing and targeted phishing attacks against employees or clients.

About Securitas Group

Securitas AB is a Swedish-based multinational security company. The organization provides a wide range of security services, including monitoring, consulting, and investigation solutions on a global scale.

Impact and organizational considerations

This incident may pose risks to Securitas Group regarding data privacy and operational continuity. Depending on the content of the compromised data, the exposure of employee or customer information could facilitate identity theft and targeted phishing attacks. As the organization is based in Sweden, a potential data breach could lead to legal and administrative sanctions under the European Union's General Data Protection Regulation (GDPR).

Public information regarding the Everest group suggests that they actively employ data theft and extortion tactics. This highlights the evolving nature of the threat landscape, where professional services firms are increasingly targeted due to the sensitive nature of the client information they manage.

For organizations operating in the professional services sector, maintaining vigilance is critical. Such incidents underscore the necessity for robust security postures to mitigate supply chain risks and protect against secondary extortion attempts. Organizations often focus on implementing multi-layered defense strategies, such as strict access controls, continuous monitoring, and comprehensive incident response plans, to defend against the sophisticated tactics used by groups like Everest.