Air Miles España, S.A Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People associated with Air Miles España, S.A. face the possibility that internal company files were removed during a ransomware incident the everest group claims to have carried out. The incident was listed publicly on November 24, 2025, yet the number of individuals whose information may be involved has not been disclosed. The practical stakes center on how such files are handled once they leave an organization’s control and whether they contain details that could be used for further targeting or resale.

Inside the incident

The only confirmed detail is that the everest ransomware group listed Air Miles España, S.A. on its leak site on November 24, 2025. The listing states that internal files were exfiltrated during a ransomware attack. No information has been released about the date of the intrusion, the volume of data taken, the method of entry, or whether any data was later published.

The number of people affected is recorded as unknown. No official statement from the company confirming or denying the claims has been referenced in the available reporting.

The group behind it: everest

Everest is a ransomware operation that maintains a public leak site where it lists organizations it claims to have compromised. The group’s standard pattern involves encrypting systems and removing copies of data, then using the threat of publication to pressure victims. Similar listings by the same actor have appeared in multiple sectors over recent years, though each claim requires separate verification.

In this case the group claims Air Miles España, S.A. as a victim; that assertion has not been independently confirmed beyond the leak-site posting itself.

About Air Miles España, S.A

Air Miles España, S.A. operates a customer loyalty program in Spain. Companies of this type maintain records that link individual participants to transaction histories, contact details, and account identifiers. They also store internal operational documents, partner agreements, and system credentials required to run the program.

A breach at such an organization is consequential because the data it holds connects directly to everyday consumer activity and to the commercial relationships that support the loyalty scheme.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No further inventory of file types or data categories has been made public. Organizations in the loyalty sector routinely hold participant registration information, purchase records, and internal administrative material, yet the precise contents of the exfiltrated files remain unconfirmed.

The real-world impact

Individuals cannot yet determine whether any of their personal details appear among the claimed files. If internal documents contain account credentials or partner data, those items could be used in follow-on attempts to access other systems. The organization faces the task of assessing what was taken and deciding whether notifications or additional security measures are required.

Both the scale of exposure and the subsequent use of any material are currently unknown.

Were you affected?

Because the number of people involved and the exact data types remain undisclosed, affected individuals should watch for direct communications from Air Miles España, S.A. and review account activity for any unusual access.

• Monitor official statements or required breach notifications from the company.
• Check bank and loyalty accounts for unrecognized activity.
• Run a free exposure scan of your email address against known breach datasets.
• Consider enabling additional verification steps on any accounts that use the same email or password.

AICompiled with AI assistance from public sources and published under our editorial standards.