Everest Ransomware Group Claims Massive Data Breach of McDonald’s India Operations The Everest ransomware group has taken responsibility for a major cyberattack on McDonald’s India, alleging the exfiltration of 861 gigabytes of sensitive corporate and customer data. The threat actors disclosed the breach on their dark web leak site on January 20, 2026, issuing a ransom demand with threats to publicly release the stolen data if payment is not made. According to Everest’s claims, the compromised dataset includes customer personal information and internal company documents, which security analysts warn could enable identity theft and targeted phishing campaigns across the Indian subcontinent. The stolen data reportedly contains names, contact details, transaction histories, and internal business records, marking one of the largest disclosed breaches targeting McDonald’s franchise operations globally. Everest, a Russian-speaking cybercriminal group active since December 2020, specializes in "pure extortion" tactics prioritizing data theft and ransom demands over traditional ransomware encryption. The group employs dual AES/DES encryption and has a history of targeting high-profile organizations, including ASUS, Nissan Motor Corporation (900 GB stolen in January 2026), and Dublin Airport (1.5 million passenger records compromised in October 2025). McDonald’s operates in India through two entities: Connaught Plaza Restaurants Private Limited (North and East India) and Hardcastle Restaurants Private Limited (West and South India). The company, which entered the Indian market in 1996, has not publicly confirmed the breach as of January 21, 2026. This incident follows previous security incidents in 2017 and 2024, highlighting recurring vulnerabilities in its infrastructure.