[EVEREST] – Ransomware Victim: Air Arabia DataBase on sale for $2 Million
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the EVEREST Onion Dark Web Tor Blog page.
AI Generated Summary of the Ransomware Leak Page
On 2025-10-25, a leak page associated with the Everest ransomware group references a victim named Air Arabia DataBase on sale for $2 Million. The page frames the incident as a data-leak sale rather than a traditional encryption event, aligning with ransomware operators’ double-extortion approach. The post asserts that Air Arabia’s database has been exfiltrated and is being offered for sale for two million USD. The metadata shows no disclosed industry, country, or official website details for the victim (the industry field is not found), and a claim URL is indicated on the leak page, though the actual address is not included in this transcription. Since a compromise date isn’t provided, the 2025-10-25 post date is used as the timeline reference. The entry does not specify data types, volume, or encryption status beyond the sale claim.
The leak page includes two image assets, which appear to be screenshots or visual references related to internal documents or data; the exact contents of these images are not described here. There is no indication of downloadable files within the page (downloads_present is false), and the metadata highlights a claim URL presence without displaying the address. The combination of a stated sale price and a claim URL is consistent with extortion-style leakage tactics, though the page provides limited detail about the dataset, its scope, or the specific data types involved. The victim’s name remains the focal point of the entry, while other company identifiers are not elaborated in the transcript.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
