The Hoff Brand SL targeted by Everest ransomware group

• Ransomware group: Everest
• Country: Spain
• Sector: Retail & E-Commerce
• Announcement date: January 16, 2025

Everest ransomware group claims data breach at The Hoff Brand SL

The ransomware group known as Everest has published an announcement on its leak site claiming to possess a significant amount of sensitive information belonging to The Hoff Brand SL. According to the group's claims, the breach involves a massive volume of data, including over 630,000 customer records and 63 GB of internal corporate documents. The announcement was made on January 16, 2025, and the group alleges that the attack occurred on the same day.

Details of the alleged attack and stolen data

The Everest group listed The Hoff Brand SL on their leak site, alleging a security breach that has resulted in the acquisition of various sensitive datasets. The group claims to have obtained detailed customer order information as well as various internal corporate documents. Furthermore, the announcement specifically references an email database that allegedly belongs to the company's CEO, suggesting that the breach may have reached high-level executive communications.

The scope of the data allegedly stolen is extensive, potentially compromising both consumer privacy and corporate integrity. The leaked data is said to include the following types of information:

• Customer names
• Email addresses
• Billing information
• Order details
• Payment methods
• Address information
• Corporate email data

While the group has claimed these specific datasets, no information was provided regarding the specific ransom demand or the exact file count of the stolen data.

About The Hoff Brand SL

The Hoff Brand SL is a Spain-based retail and e-commerce company. The organization focuses its business operations on the design and sale of sneakers and various fashion products.

Analysis and potential impact of the incident

The Everest group is a Russian-speaking actor that has been active since 2020. The group is widely known in the cyber threat intelligence community for its involvement in data theft and extortion activities. This specific incident highlights the risks faced by modern e-commerce entities, where the exposure of customer data can lead to severe consequences. For the customers of The Hoff Brand SL, the alleged leak of names, addresses, and payment methods could expose them to significant risks, such as identity theft and highly targeted phishing campaigns.

From a regulatory perspective, since the company is based in Spain, a confirmed breach of this magnitude could lead to significant legal consequences and administrative fines under the General Data Protection Regulation (GDPR). Furthermore, the company may face a negative impact on its commercial reputation. The nature of the claim suggests that the group may employ double extortion tactics, a method where attackers not only encrypt a company's data but also threaten to leak sensitive information publicly to increase pressure for payment.

The scale of the exposed data suggests that both corporate operations and customer privacy could be significantly compromised. In such scenarios, organizations typically face the challenge of managing both technical recovery and legal compliance. For companies in the retail and e-commerce sector, maintaining robust security postures is critical to preventing such breaches. This includes implementing strong access controls, monitoring for unauthorized data exfiltration, and ensuring that executive communications are heavily protected. As the scope of this incident indicates, the theft of internal documents and executive emails can provide attackers with the leverage needed to disrupt business operations and damage brand trust.