Everest Ransomware Group Claims Massive Data Breach at McDonald’s India The Everest ransomware group has alleged a major cyberattack on McDonald’s India, claiming to have exfiltrated 861 GB of sensitive data, including internal documents and customer personal information. The threat actors posted details of the breach on their dark web leak site on January 20, 2026, warning that the stolen data would be publicly released if McDonald’s fails to respond by a specified deadline. According to Everest, the compromised data includes a wide range of personal and corporate records, posing risks of identity theft and targeted phishing attacks. The group, a Russian-speaking operation active since December 2020, specializes in "pure extortion" stealing and selling data rather than solely encrypting files. Known for high-profile attacks, Everest’s recent victims include ASUS, Nissan Motor Corporation (900 GB stolen in January 2026), and Dublin Airport (1.5 million passenger records breached in October 2025). McDonald’s India, which operates through Connaught Plaza Restaurants (North/East India) and Hardcastle Restaurants (West/South India), has not yet confirmed the breach. The incident adds to the company’s history of cybersecurity challenges in the region, following previous data security issues in 2017 and 2024. The full scope and impact of the breach remain under investigation.

Everest Ransomware Group Claims Massive Data Breach of McDonald’s India Operations The Everest ransomware group has taken responsibility for a major cyberattack on McDonald’s India, alleging the exfiltration of 861 gigabytes of sensitive corporate and customer data. The threat actors disclosed the breach on their dark web leak site on January 20, 2026, issuing a ransom demand with threats to publicly release the stolen data if payment is not made. According to Everest’s claims, the compromised dataset includes customer personal information and internal company documents, which security analysts warn could enable identity theft and targeted phishing campaigns across the Indian subcontinent. The stolen data reportedly contains names, contact details, transaction histories, and internal business records, marking one of the largest disclosed breaches targeting McDonald’s franchise operations globally. Everest, a Russian-speaking cybercriminal group active since December 2020, specializes in "pure extortion" tactics prioritizing data theft and ransom demands over traditional ransomware encryption. The group employs dual AES/DES encryption and has a history of targeting high-profile organizations, including ASUS, Nissan Motor Corporation (900 GB stolen in January 2026), and Dublin Airport (1.5 million passenger records compromised in October 2025). McDonald’s operates in India through two entities: Connaught Plaza Restaurants Private Limited (North and East India) and Hardcastle Restaurants Private Limited (West and South India). The company, which entered the Indian market in 1996, has not publicly confirmed the breach as of January 21, 2026. This incident follows previous security incidents in 2017 and 2024, highlighting recurring vulnerabilities in its infrastructure.