Loading story…
The Everest ransomware group has claimed responsibility for significant cyberattacks against Iberia, Spain's national airline, and Air Miles España, the operator of the Travel Club rewards program. In these incidents, Everest reportedly exfiltrated 596 GB of sensitive data from Iberia, including personal and payment information, loyalty details, travel histories, and booking-related communications for millions of customers across multiple countries. The attackers also claim to have had the ability to manipulate bookings, such as changing contact details, modifying seats, and cancelling tickets, posing a severe risk to passenger data security and operational integrity. For Air Miles España, Everest claims to have stolen approximately 131 GB of data and locked internal systems, following a double extortion model where files are both stolen and systems encrypted to pressure for ransom payment.
The breaches have raised significant concerns about identity theft, phishing, and regulatory compliance, particularly under GDPR, given the scale and sensitivity of the compromised data. The Everest group has threatened to leak the stolen information if negotiations with the affected organizations fail, a tactic consistent with their previous operations. The attacks highlight a growing trend of ransomware groups targeting high-profile entities in the travel and rewards sectors, with potential impacts extending to millions of individuals and business partners in Spain, Latin America, and other regions where Iberia and Travel Club operate.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
AhnLab ASEC's Week 4 November 2025 roundup included the Everest incident, describing it as a data-exfiltration attack against Spain's largest airline. This was a follow-on report of the already disclosed Iberia event rather than a new incident.
Everest also claimed a separate attack on Air Miles España, operator of the Travel Club rewards program, alleging theft of about 131 GB of data and disruption of internal systems. The reportedly stolen information included personal and loyalty account data affecting customers and business partners.
The Everest ransomware group claimed it breached Iberia, Spain's national airline, and stole a large dataset reportedly including customer identity, loyalty, and payment information. Reports also said the group claimed it could manipulate bookings, raising risks for millions of customers across multiple countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Everest ransomware group claimed responsibility for a significant cyberattack on Dublin Airport, exfiltrating the personal data of over 1.5 million passengers. The stolen information includes full names, flight details, frequent flyer information, baggage tag numbers, and other sensitive travel data. The group listed Dublin Airport as a victim on its leak site, password-protecting the data and demanding negotiations within six days to prevent public release. Irish authorities and the National Cyber Security Centre have launched investigations, while Dublin Airport faces the challenge of rebuilding its affected servers from scratch. The attack highlights critical vulnerabilities in aviation infrastructure, particularly the reliance on centralized software platforms such as Collins Aerospace’s MUSE system. The incident has caused operational disruptions, forcing manual fallback procedures and resulting in significant delays and inconvenience for passengers. The Everest campaign underscores the urgent need for enhanced cybersecurity resilience across the aviation sector, as the breach not only threatens data privacy but also exposes the operational fragility of major airports.
Jun 29, 2026
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026
Iberia, Spain's largest airline and a member of the International Airlines Group (IAG), has disclosed a data breach affecting customer information following a security incident at one of its third-party suppliers. The breach was revealed after a threat actor claimed on hacker forums to possess 77 GB of data allegedly stolen from the airline. Exposed data includes customer names, email addresses, and Iberia Club loyalty card identification numbers. Iberia has confirmed that no account passwords or financial information were compromised in the incident. Upon discovering the breach, Iberia activated its security protocols, implemented additional technical and organizational measures, and notified relevant authorities. The airline has also enhanced protections around customer email addresses, now requiring verification codes for changes, and is monitoring its systems for suspicious activity. Customers have been advised to remain vigilant for suspicious communications and to report any anomalous activity. The investigation is ongoing in coordination with the affected supplier, and as of the latest update, there is no evidence of fraudulent use of the compromised data.
Jun 29, 2026