Evaluate a Norstella company Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 15, 2026, the ransomware group known as Everest listed Evaluate, a Norstella company, on its leak site. Public records show only that internal files were claimed to have been exfiltrated during a ransomware attack. The number of individuals affected remains unknown, and no further technical details or confirmation of the data’s contents have been released by the organization or independent investigators. This incident reflects a continuing pattern in which ransomware operators target mid-sized enterprises that hold commercially sensitive information. Such listings prompt organizations and regulators to examine whether customer or employee data may have been exposed, even when the precise scope is not yet clear.

Breaking down the breach

The only confirmed public information is the March 15, 2026 listing by Everest and the statement that internal files were allegedly exfiltrated. No figure for the volume of data, the date of the intrusion, or the method of initial access has been disclosed. The organization has not issued a separate statement confirming or denying the claims.

Who is everest?

Everest is a ransomware group that has operated since at least 2023. It follows the double-extortion model common among current ransomware actors: it encrypts systems and also removes copies of files, then uses a leak site to pressure victims. The group’s listings are public claims; independent verification of each incident is not always available at the time of posting.

Who is Evaluate a Norstella company?

Evaluate operates as part of Norstella, a firm that supplies market-intelligence and consulting services to the life-sciences industry. Organizations in this sector routinely collect and store proprietary commercial data, regulatory submissions, and information about clinical development programs. A breach affecting such an entity can therefore involve records whose sensitivity extends beyond routine customer information.

The information in question

The listing refers to “internal files exfiltrated in ransomware attack.” No inventory of specific file types or data categories has been published. Companies of this kind typically hold business plans, client lists, financial models, and research documents; whether any of those categories were taken in this case is unconfirmed.

Why it matters

Exposure of internal commercial files can create competitive or regulatory consequences for the affected organization and its clients. If any of the files contain personal information, individuals could face risks of targeted fraud or identity misuse, though the presence of such data has not been established. The absence of a confirmed count of affected people means the full scope of potential harm cannot yet be assessed.

Were you affected?

Because the number of individuals involved is unknown, anyone who has shared personal or professional information with Evaluate or its clients should monitor their accounts and financial statements for unusual activity. Readers may also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.