Solaris Pharma targeted by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: January 14, 2025

The threat actor known as Everest has claimed responsibility for a cyberattack against Solaris Pharma. According to an announcement posted on a leak site on January 14, 2025, the group alleges they successfully breached the internal network of the organization and exfiltrated a significant volume of sensitive information.

The alleged breach and claims by Everest

According to the claims made by the Everest group, they gained access to the internal network systems of Solaris Pharma on January 14, 2025. The group asserts that this unauthorized access allowed them to exfiltrate more than 400 GB of internal and confidential data during the incident. This type of activity is characteristic of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt systems but also steal sensitive data to use as leverage during negotiations.

The group has reportedly posted a ransom note regarding this incident. In this communication, they have requested that representatives from Solaris Pharma contact them directly. The stated purpose of this contact is to prevent the public release and publication of the documents they claim to have stolen. While the group has made these claims, the specific details regarding the ransom demand itself have not been disclosed in the available information.

Details of the allegedly exfiltrated data

The scope of the data theft, as claimed by the Everest group, involves a substantial amount of information. The group alleges that the stolen data consists of internal confidential documents and contract information. The specific contents of the files have not been released, but the group claims the volume of stolen data exceeds 400 GB.

• Internal confidential documents
• Contract information

Implications and potential risks

The claims made by the Everest group could result in significant negative impacts on the operational processes of Solaris Pharma. Given the sensitive nature of the data allegedly stolen, the organization may face various legal sanctions and compliance challenges under the strict regulations governing the healthcare sector. Such incidents often require organizations to navigate complex regulatory landscapes to ensure they are meeting all legal obligations regarding data protection.

Beyond the immediate operational disruption, the organization could face secondary risks. These include the potential for identity theft or the execution of targeted phishing attacks against the company or its stakeholders. The group involved, Everest, has been active since 2020, and their past methods suggest that the publication of stolen data can lead to substantial reputational damage for the victimized organization.

For organizations operating within the healthcare sector, incidents of this nature underscore the necessity of robust data security policies. The scale of this alleged breach may require a comprehensive re-evaluation of existing security frameworks to mitigate future risks. General defensive strategies for organizations facing such threats often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.