Viking Automation listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: Norway
• Sector: Manufacturing
• Announcement date: August 9, 2025

Everest ransomware group targets Viking Automation

The threat actor known as Everest has listed the Norwegian technology company Viking Automation on its dedicated leak site. According to the announcement made on August 9, 2025, the group claims that the organization was involved in a cyber incident occurring on July 28, 2025. This development follows the common patterns observed in modern ransomware operations, where threat actors utilize public leak sites to pressure victims into meeting specific demands.

The Everest group is recognized as a Russian-speaking entity that has been active since 2020. The group specializes in several high-impact cybercriminal activities, including data exfiltration, extortion, and the unauthorized sale of access to compromised networks. Such groups often employ double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive information to use as leverage during negotiations.

Details of the claimed incident

The listing provided by the Everest group focuses on the claim that Viking Automation was compromised during an event on July 28, 2025. While the group has officially announced the victim on their platform, they have not provided any specific details regarding the nature of the allegedly leaked data. Furthermore, no sample files have been released to substantiate the claim of a successful data theft.

The listing names no specific data types that have been compromised in the alleged attack.

About Viking Automation

Viking Automation is a technology company based in Norway. The organization provides specialized engineering solutions, control panels, and automation systems. Their services are primarily directed toward the maritime, oil, and gas industries, providing critical technology for these essential industrial sectors.

Potential impact and industry implications

The situation involving Viking Automation carries significant risks for the organization. This incident may lead to disruptions in the institution's operational processes and cause damage to its commercial reputation. Because the organization is based in Norway, any potential data breaches may be subject to GDPR regulations, which could result in legal consequences for the entity involved.

Beyond the immediate operational and legal risks, secondary risks may include the misuse of employee data or the execution of targeted phishing attacks against corporate networks. In many ransomware scenarios, once data is exfiltrated, it can be used to fuel further social engineering campaigns against the company's employees or partners.

Given the established history and past activities of the Everest group, there is a possibility that the data could be made public if the institution does not meet the ransom demands. In the broader context of cybersecurity, organizations in the manufacturing and industrial sectors often face these types of threats due to the critical nature of their operational technology and the high value of their proprietary engineering data. To defend against such threats, organizations typically focus on robust backup strategies, network segmentation, and continuous monitoring to detect unauthorized access before data exfiltration can occur.