Epiq Global Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 2, 2026, the ransomware group Everest listed Epiq Global on its leak site, stating that internal files had been taken during a ransomware attack. The number of people whose information may be involved is not known, and no further details about the scale or timing of the incident have been released publicly. The listing draws attention to a company that processes large volumes of legal and administrative records on behalf of clients across multiple sectors. Because the exact nature of the files remains undisclosed, individuals connected to matters handled by Epiq Global have limited information about whether their personal details are among the material in question.

Breaking down the breach

The only confirmed public information is the May 2, 2026 listing by Everest and the group’s statement that internal files were exfiltrated. No figure for the volume of data, the number of affected individuals, or the date of the underlying intrusion has been disclosed. The organization has not issued a separate statement confirming or denying the claims at the time of reporting.

Who is everest?

Everest is a ransomware group that has conducted operations involving both file encryption and data theft. Like similar actors, it maintains a leak site where it lists organizations and publishes samples or claims of stolen material when ransom demands are not met. The group’s listing of Epiq Global constitutes an unverified claim by the actor; independent confirmation of the data’s authenticity or extent has not been made public.

Who is Epiq Global?

Epiq Global is a United States-based legal services company that supplies technology-driven support for complex legal proceedings. Its work includes class-action and mass-tort administration, bankruptcy case management, electronic discovery, document review, and legal notification. The firm operates in multiple countries and serves law firms, corporations, and government entities that require assistance managing large-scale legal matters.

The information in question

The listing refers only to “internal files” taken in a ransomware attack. No specific categories of personal data have been named. Organizations of this type routinely hold records that can include names, addresses, contact details, financial information, and sensitive legal documents belonging to plaintiffs, defendants, or other parties in proceedings. The precise contents of any exfiltrated material remain unconfirmed.

Why it matters

Legal-services providers hold records that often contain detailed personal and financial information tied to ongoing or past litigation. Exposure of such material can create long-term privacy and identity risks for the individuals involved, even when the total number of records is unknown. For the organization, the incident adds to operational and reputational pressures common to entities that manage regulated legal data.

What to do if you're exposed

Individuals who believe their information may have been involved should monitor accounts for unusual activity and consider placing fraud alerts with credit bureaus. Changing passwords and enabling multi-factor authentication on any linked services provides a basic layer of protection. Readers can run a free exposure scan of their email address to check whether it appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.