Kingston Technology Investigates Alleged Data Breach by Everest Ransomware Group Kingston Technology, a leading manufacturer of PC hardware and storage solutions, is investigating claims of a data breach after the Everest ransomware group asserted it stole nearly 138.5 GB of marketing materials. The breach, disclosed on August 20 via the group’s darknet leak site, reportedly includes 9,438 files primarily targeting the Asia-Pacific region, covering markets such as Taiwan, Japan, Korea, Thailand, Vietnam, India, Australia, New Zealand, Malaysia, and Singapore. The stolen data encompasses regional marketing assets, product launch materials, localization packages, retail and e-commerce content, corporate communications, and design files including resources for Kingston’s HyperX gaming peripherals. While Everest provided a screenshot of a Windows directory as partial proof, no ransom demand has been made public. The group has threatened to release the data within six days if demands are not met. Everest, a Russian-speaking ransomware operation active since 2021, has a history of targeting hardware manufacturers, including recent breaches at Asrock Rack and ASUS. The group employs tactics such as credential exploitation, insider recruitment, and abuse of remote access tools. Notably, Everest was linked to a 2025 cyberattack on Collins Aerospace, which disrupted European airports. Kingston, headquartered in California with global manufacturing facilities, confirmed it is aware of the claims but stated operations remain unaffected. The company produces RAM, SSDs, USB drives, and gaming peripherals under the HyperX brand. Further details on the breach’s scope and impact are pending investigation.

DigiCert Revokes Fraudulently Obtained Certificates Following Cyberattack On April 2, digital certificate authority DigiCert fell victim to a cyberattack after a threat actor targeted its support team with malware disguised as a screenshot in a customer chat channel. The malicious payload infected two endpoints one detected on April 3 and another on April 14, with the delayed discovery of the second infection attributed to malfunctioning security tools. The attackers exploited a limited-access function in DigiCert’s internal support portal, leveraging the ability of authenticated support analysts to proxy into customer accounts. This allowed them to obtain initialization codes for pending Extended Validation (EV) Code Signing certificate orders. With these codes and approved orders, the threat actor successfully issued fraudulent certificates across multiple customer accounts and certificate authorities (CAs). By April 17, DigiCert identified and revoked 60 certificates tied to the incident, including 27 directly linked to the attacker. Of these, 11 were reported by the cybersecurity community and had been used to sign the Zhong Stealer malware. The company confirmed that no other internal systems were compromised beyond the unauthorized access to initialization codes. In response, DigiCert revoked all potentially affected certificates, canceled pending orders to block further exploitation, and implemented stricter security measures. These include enforcing multi-factor authentication (MFA) for administrative workflows, restricting support users from accessing initialization codes, limiting file types in support chats and Salesforce case attachments, and enhancing logging capabilities.