Everest claims to have breached McDonald’s India, 861GB of data allegedly stolen

Ransomware operation Everest alleges to have infiltrated McDonald’s India, the Indian subsidiary of the American fast-food restaurant.

In a post on a popular hacking forum, the ransomware group claims to have exfiltrated 861GB of customer data and internal company documents.

“Personal data of your customers and internal documents were leaked into our storage. The leak of your internal company documents contains a huge variety of personal documents and information of clients,” the attackers write on their dark web leak site.

To support its claims, the hacking group published several screenshots, detailing the contents of folders they have allegedly looted.

According to Hackread, the media outlet that first reported the data breach, these screenshots show a mixed bag of personal and corporate information, including financial reports from 2023 to 2026, audit trails, cost tracking sheets, ERP migration files, pricing data, and other sensitive internal communications.

One of the screenshots shows a folder called “Contact Database.” This one contains detailed information on investors and business partners, including names, mailing addresses, phone numbers, and email addresses across India, Singapore, the United States, and the United Kingdom.

Among others, other folders include corporate announcements, industry reports, research analyst reports, and investor information. The latter possibly includes confidential information that’s only meant for Board Members.

As of writing, McDonald’s India hasn’t responded to the incident.

According to Cybernews’ dark web monitoring tool, Ransomlooker, Everest has made over 250 victims since 2023.

The ransomware group claims to have attacked several major corporations, including Dublin Airport, Collon Aerospace, Coca-Cola’s Middle East division, Crumbl, Mailchimp, Nissan, ASUS, Under Armour, and AT&T.