Sarmap Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Sarmap was listed by the everest ransomware group on December 02, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; check any notices or contact Sarmap if you believe your information was involved.
Inside the incident
The only confirmed information is the group’s listing of Sarmap and the claim that internal files were taken. No date of the intrusion, volume of data, or technical details have been disclosed. The organization has not issued a public statement confirming or denying the claims at the time of reporting.
The group behind it: everest
Everest is a ransomware operation that uses double-extortion tactics, encrypting systems and threatening to publish stolen data. The group maintains a leak site where it lists victims and posts samples of claimed material. Its listings are presented by the group itself and are not independently verified unless corroborated by the affected organization or law-enforcement statements.
Sarmap and its sector
Sarmap was established in 1998 and develops software tools for the remote-sensing community, with a focus on radar and radar-satellite data processing and distribution. Its work supports applications in agriculture, environmental monitoring, and disaster response. Organizations in this sector routinely handle technical datasets, project files, and communications with government and research partners.
What was likely exposed
The listing refers only to “internal files exfiltrated.” No inventory of specific file types or data categories has been released.
- Internal files exfiltrated in ransomware attack
- Exact contents and volume remain undisclosed
Why it matters
Earth-observation data and related project files can contain sensitive technical information or details about monitoring activities that affect public safety and commercial operations. Even without confirmed personal data, exposure of internal files can create operational, contractual, or regulatory consequences for the company and its clients.
If your data was in this claimed breach
Monitor official statements from Sarmap for any guidance on affected individuals. Use strong, unique passwords and enable multi-factor authentication on accounts that may share credentials with the organization. Readers can run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Collins Aerospace Admits Responsibility for Flight Chaos at Heathrow, Brussels and Other M... Listed by everest Ransomware GroupMUSE-INSECURE: Inside Collins Aerospaces Security Failure Listed by everest Ransomware GroupMUSE-INSECURE: Inside Colins Aerospaces Security Failure Listed by everest Ransomware GroupEverest file server Listed by everest Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Sarmap Listed by everest Ransomware Group →
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.