Umiles Group listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Spain
• Sector: Professional Services
• Announcement date: April 20, 2026

Everest ransomware group targets Umiles Group

The ransomware group known as Everest has officially listed the Spanish technology company Umiles Group on its dedicated leak site. This announcement, made on April 20, 2026, indicates that the threat actors claim to have successfully exfiltrated data belonging to the organization. While the listing confirms the group's intent to leverage stolen information, the specific volume of data and the exact nature of the intrusion remain unconfirmed by the victim.

In the context of modern cyber extortion, such listings are a common component of double extortion tactics. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the stolen data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal information.

Details of the claim and the threat actor's ultimatum

According to the announcement posted on the Everest leak platform, the group has claimed to possess data belonging to Umiles Group. The threat actor has issued a specific ultimatum: if the company fails to establish contact with the attackers, the data they claim to have obtained will be published publicly. This method is designed to maximize psychological pressure on the target organization.

To demonstrate the validity of their claim, the Everest group has shared several document samples alongside their announcement. These samples serve as proof of the breach to the public and the victim, intended to validate the group's ability to access the internal environment of the target. At this time, no information has been provided regarding the specific ransom demand or the total amount of data stolen.

Data samples and affected information

The screenshots provided by the group as evidence of the breach show various types of documents. These samples include various forms, technical papers, and the names of personnel associated with the organization. Based on the available information, the following types of data are reported to be involved in the incident:

• Corporate technical documents
• Personnel data

The presence of these document types suggests that the breach may involve sensitive internal operational details and personal information of the company's workforce.

About Umiles Group

Umiles Group is a technology company based in Spain that specializes in unmanned aerial vehicle (UAV) technologies, drone services, and air mobility solutions. The company's operations are centered around drone operations, specialized training, and the development of advanced aerial technologies. As a player in the high-tech sector involving unmanned systems, the company operates in a field characterized by significant technical complexity and specialized intellectual property.

Analysis and potential implications

Given the past activities of the Everest group, it is assessed that this incident may result in the actual exposure of corporate data. Because Umiles Group is based in Spain, any confirmed data breach involving personal information could lead to significant legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). The shared samples suggest that sensitive information regarding the company's operational processes may already be at risk.

Furthermore, the leaked data could potentially be utilized in secondary attacks. This includes targeted phishing campaigns or attempts at corporate identity theft, where the stolen information is used to impersonate employees or gain further access to the organization's infrastructure. Publicly available information regarding the Everest group remains limited, making it difficult to predict their long-term patterns.

For organizations operating in high-tech and specialized service sectors, such incidents highlight the importance of robust data protection strategies. Common defensive steps often include implementing strict access controls, maintaining comprehensive logging to detect unauthorized exfiltration, and ensuring that sensitive technical documentation is encrypted both at rest and in transit. Additionally, because stolen data is frequently used for follow-on social engineering attacks, organizations must maintain high levels of vigilance regarding phishing attempts targeting their personnel.