Izmocars Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Izmocars has been listed by the everest ransomware group, with internal files reportedly exfiltrated. The listing was disclosed on December 20, 2024; an undisclosed number of individuals may have been affected and should check whether their data was involved.
On December 20, 2024, the ransomware group known as everest listed Izmocars on its leak site, claiming to have exfiltrated internal files in a ransomware attack. Public reporting indicates more than 200GB of .msg files were involved, along with references to multiple related domains and entities. The number of people affected remains unknown, and independent confirmation of the full scope is limited.
For individuals or partners connected to Izmocars or its associated brands, the listing raises practical questions about what internal correspondence and business data may now be at risk of wider exposure. Details beyond the group's claims and the reported volume of files have not been publicly verified.
What happened
According to the available record, Izmocars was listed by the everest ransomware group on December 20, 2024. The group claims the incident involved a ransomware attack in which internal files were exfiltrated. The reported summary states a total volume of more than 200GB of .msg files. No further public detail has been provided on the precise timing of the intrusion, the initial access method, or whether any ransom demand was met. The number of individuals potentially affected is listed as unknown. The listing itself constitutes a claim by the group rather than independently confirmed disclosure of every file.
Who is everest?
Everest is a ransomware operation that has been publicly documented for several years. Like many groups in this category, it typically employs double-extortion tactics: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not received. The group has previously listed a range of corporate victims across different sectors, using its site to post sample files or full archives as pressure. Public reporting on everest generally describes it as opportunistic rather than highly selective, focusing on organisations whose data can be leveraged for financial gain. In this case, the appearance of Izmocars on the leak site is presented solely as the group's claim; no additional statements attributed specifically to everest about this victim beyond the listing and the volume of .msg files have been included in the available facts.
Who is Izmocars?
Izmocars operates in the automotive digital-services sector. Organisations of this type commonly provide marketing platforms, dealer websites, inventory tools, and related online services for car manufacturers, dealerships, and aftermarket businesses. Publicly associated domains and brand names linked in the reported file list include entities such as izmocars, izmoltd, izmomedia, carazoosolutions, and several country- or product-specific sites. Companies in this space routinely hold internal correspondence, client contracts, marketing materials, and operational records that support dealer networks and digital campaigns. A breach involving such an organisation is consequential because the data often spans multiple business partners and geographic markets, potentially affecting not only the primary company but also dealers, suppliers, and end customers who interact with its platforms.
The information in question
The facts name the exposed material as internal files exfiltrated in a ransomware attack, specifically more than 200GB of .msg files. Exact contents of those messages and any accompanying documents remain unconfirmed beyond the group's listing. The reported summary references a series of associated names and domains. Concrete items listed include:
- More than 200GB of .msg files
- References to izmoltd, izmocars, izmolaw, izmomedia, izmolimited.com
- izmocars.be, carazoosolutions.com, auto-marketing.pro, carazoo.com, carsite.com, cartalking.com
- citadeldefence.com, citadelint.in, citadelint.net, cpa-marketing.pro, deepheritage.com, deepjansevasamiti.com
- dgipro.com, dgipro-design.com, digitalnanotechsg.com, franchisenow.pro, ipricecars.com, izmocars.fr
- izmocrm.com, izmodirect.com, izmoeurope.be, izmoinc.com, izmolaw.com, izmomedia.com
- izmonet.com, izmostock.com, izmostudio.com, izmoweb.com, izmoweb.in, legal-marketing.pro
- partsgorilla.com, smart-shiksha
Organisations of this kind typically store email archives, client lists, financial correspondence, and project files. Because the precise data types beyond the .msg volume are not further detailed in public reporting, any assumption about specific personal or financial records would be speculative.
What's at stake
For people whose information may appear in the exfiltrated files, the primary risks include unsolicited contact, phishing attempts that reference genuine internal details, and potential misuse of business relationships. Email archives often contain names, addresses, phone numbers, and negotiation histories that can be weaponised for social engineering. For Izmocars itself and its partner network, the exposure of internal correspondence can damage commercial trust, reveal competitive information, and create regulatory or contractual obligations to notify affected parties. Because the number of people affected is unknown and the full contents remain unverified, the practical impact is still emerging. Organisations in the automotive digital sector also face secondary risks if dealer or customer data is later confirmed to be present, which could affect service continuity and reputation across multiple markets.
Were you affected?
If you have done business with Izmocars or any of the associated entities named in the listing, treat the situation as a potential exposure until more information becomes available. Practical first steps include monitoring email accounts for unusual activity, enabling multi-factor authentication where possible, and being cautious of messages that appear to reference internal projects or contacts. Change passwords on any accounts that may have been used in correspondence with the company. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited; further official statements from Izmocars or independent verification would be required to clarify the exact scope.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
IndicaOnline Listed by everest Ransomware GroupCrimsgroup Data Leak Listed by everest Ransomware GroupCrimsgroup Listed by everest Ransomware GroupPrimeimaging database for sale Listed by everest Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Izmocars Listed by everest Ransomware Group →
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.