MalwarePublished 28 Oct 2025

Everest Ransomware Leaks AT&T Carrier Records, Demands $1M for Dublin Airport Passenger Data

Source Reddit InfoSec News

Description

The Everest ransomware group has reportedly leaked sensitive records from AT&T, a major telecommunications carrier, and is demanding a $1 million ransom for passenger data related to Dublin Airport. This incident highlights the growing trend of ransomware actors targeting critical infrastructure and high-profile organizations to extract large ransoms. The leak of carrier records and airport passenger data poses significant risks to confidentiality and privacy. European organizations, especially those connected to aviation and telecommunications sectors, could face increased exposure to data breaches and operational disruptions. Mitigation requires targeted incident response, enhanced monitoring of sensitive data flows, and collaboration with law enforcement. Ireland is particularly at risk due to the direct targeting of Dublin Airport, while other European countries with major airports and telecom providers may also be affected. Given the medium severity rating and lack of known exploits in the wild, the threat is serious but not yet widespread. Defenders should prioritize securing access controls and data exfiltration detection to prevent similar attacks.

Impact

For European organizations, this threat presents multiple risks. The direct targeting of Dublin Airport passenger data poses a significant privacy risk under GDPR, potentially leading to regulatory fines and reputational damage. Telecommunications providers similar to AT&T in Europe could be targeted next, risking exposure of sensitive customer data and disruption of communication services. The leak of carrier records and passenger information can facilitate identity theft, fraud, and targeted phishing campaigns. Operationally, airports and telecom operators may face service interruptions or degraded performance if ransomware encryption or follow-on attacks occur. The threat also raises concerns about the security of critical infrastructure in Europe, especially in countries with major international airports and large telecom markets. The ransom demand of $1 million indicates the attackers' confidence in the victim's ability to pay, suggesting financially significant targets. The medium severity implies that while the immediate impact may be contained, the potential for escalation and broader attacks remains. European organizations must consider the threat actor's tactics, techniques, and procedures (TTPs) to enhance their defensive posture.

Defensive guidance

European organizations should implement targeted mitigation strategies beyond generic ransomware advice. First, conduct thorough audits of access controls and network segmentation, particularly around sensitive data repositories such as passenger databases and telecom records. Deploy advanced data loss prevention (DLP) solutions to monitor and block unauthorized data exfiltration attempts. Enhance endpoint detection and response (EDR) capabilities to identify ransomware behaviors early, including unusual file encryption or lateral movement. Regularly update and patch all systems, focusing on vulnerabilities that could provide initial access. Conduct phishing awareness training tailored to the latest social engineering tactics used by ransomware groups. Establish incident response plans that include coordination with law enforcement and data protection authorities, especially for GDPR compliance. Consider deploying deception technologies to detect attacker presence before data exfiltration. For airports and telecom operators, implement strict third-party vendor risk management to prevent supply chain compromises. Finally, maintain offline, immutable backups of critical data to enable recovery without paying ransom.

Summary

The Everest ransomware group has conducted a cyberattack resulting in the leakage of sensitive data from AT&T, a leading telecommunications carrier, and has issued a ransom demand of $1 million specifically for passenger data associated with Dublin Airport. This ransomware incident involves unauthorized access to critical data repositories, followed by data exfiltration and public disclosure to pressure the victim into paying the ransom. The attack underscores the increasing sophistication of ransomware actors who now combine encryption with data theft and extortion, targeting organizations with high-value data. The leaked AT&T carrier records likely contain sensitive customer and operational information, while the Dublin Airport passenger data could include personally identifiable information (PII) and travel details, raising privacy and regulatory concerns. Although no specific affected software versions or vulnerabilities have been identified, the attack demonstrates the threat posed by ransomware groups leveraging social engineering, phishing, or exploitation of network weaknesses to gain initial access. The absence of known exploits in the wild suggests this may be a targeted attack rather than a widespread campaign. The medium severity rating reflects the significant confidentiality impact and potential operational disruption, balanced against the current limited scope and lack of evidence for automated exploitation. The incident was initially reported on Reddit's InfoSecNews subreddit and covered by hackread.com, indicating early-stage public awareness and ongoing investigation.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Oct 2025, 22:43 UTC

Technical details

References

Community reviews

Related threats