Potential Everest Ransomware Attack on McDonald’s India (January 2026)

On 20 January 2026, the Everest ransomware group publicly claimed responsibility for a cyberattack against McDonald’s India, alleging the exfiltration of ~861 GB of sensitive corporate and customer data. The threat actors issued extortion demands and threatened to release stolen data on their leak site if negotiations failed.

The attack demonstrates continued escalation of double-extortion ransomware campaigns targeting multinational enterprises operating in India, with potential exposure of financial records, internal communications, and partner data.

The attackers stated that “personal data of your customers and internal documents were leaked into our storage,” including a “huge variety of personal documents and information of clients”. The stolen data reportedly contains internal records that could pose significant risks for identity theft and targeted phishing campaigns across the region.

11Alleged Impact & Data Exposure

Everest ransomware operators claim to have exfiltrated approximately 861 GB of sensitive data from McDonald’s India infrastructure prior to encryption.

• Financial and accounting records
• Internal corporate communications and audit data
• Pricing, procurement, and business intelligence documents
• Partner and investor contact databases across India, the US, UK, and Singapore
• Potential personally identifiable information (PII) of customers and employees

The exposure presents risks of financial fraud, corporate espionage, regulatory penalties, and reputational damage.

3. Threat Actor Profile: Everest Ransomware Group

• Russian-speaking ransomware-as-a-service (RaaS) operation active since ~2020
• Uses double-extortion model (data theft + encryption)
• Employs bespoke ransomware builds and rotating infrastructure
• Targets multinational enterprises and critical infrastructure sectors

3. Technical Indicators of Compromise (IOCs)

3.1 File and Malware Indicators

Category	Indicator
Encrypted file extensions	.everest, .eggs
Ransom note filenames	EVEREST_README.txt, HOW_TO_DECRYPT.txt
Encryption method	AES + RSA hybrid encryption
Backup destruction	vssadmin delete shadows /all /quiet

5.2 Process / Command-Line Indicators

• vssadmin delete shadows /all /quiet
• wmic shadowcopy delete
• bcdedit /set {default} recoveryenabled no

5.3 Network and Behavioral Indicators

• RDP brute-force or compromised credential-based access
• Active Directory reconnaissance via SMB/LDAP
• Lateral movement using SMB, RDP, PsExec
• Large outbound data transfers prior to encryption
• Use of TOR or custom FTP infrastructure for exfiltration

5.4 Dark-Web Infrastructure Indicators

• Everest Tor-based leak portal (“Everest Blog”)
• Tor-based victim negotiation portals
• Affiliate-operated onion services with high churn rate

6. Attack Tactics, Techniques, and Procedures (TTPs) Attack Phase MITRE ATT&CK Technique Initial Access Valid Accounts, RDP Brute Force Discovery LDAP and Active Directory Enumeration Lateral Movement SMB, PsExec, RDP Defense Evasion Shadow Copy Deletion Exfiltration Custom FTP / Cloud Storage Impact File Encryption and Extortion 7. Business Risk Assessment Operational Risk

• Potential disruption to franchise operations, supply chain, and corporate systems
• Compromise of ERP and financial platforms

Data Privacy and Compliance Risk

• Potential violations of India’s DPDP Act and global data protection laws (GDPR)
• Exposure of investor and partner data could trigger contractual liabilities

Reputational Risk

• Public extortion campaigns intended to pressure ransom payment
• Consumer trust degradation and brand impact

8. Threat Hunting and Detection Recommendations Host-Based Detection

• Monitor for .everest file extensions and EVEREST_README.txt artifacts
• Detect shadow copy deletion and backup tampering commands

Network-Based Detection

• Alert on large outbound data transfers to unknown destinations
• Detect TOR traffic within enterprise networks
• Monitor anomalous RDP authentication attempts

Preventive Controls

• Disable unnecessary RDP exposure and enforce MFA
• Implement immutable offline backups
• Deploy EDR with ransomware behavioral blocking

9. Intelligence Gaps

• No publicly confirmed malware hashes or C2 infrastructure disclosed
• McDonald’s India has not publicly confirmed breach scope
• Attribution currently based on threat actor claim

10. Strategic Outlook

This incident highlights Everest’s continued focus on high-value APAC enterprise targets and the growing trend of data-theft-driven extortion. If negotiations fail, public data leaks are likely, consistent with Everest’s historical campaigns.

References

• Cybernews: Everest ransomware claims McDonald’s India breach
• SC Media: Evidence screenshots and data exposure claims
• Cyber Press and OSINT breach tracking platforms confirming listing