Everest Ransomware Group Claims Breach of McDonald’s India, Allegedly Stealing 861 GB of Data On January 20, 2026, the Everest ransomware group announced on its dark web leak site that it had breached McDonald’s India, the fast-food chain’s Indian subsidiary. The attackers claim to have exfiltrated 861 GB of sensitive data, including financial reports, audit trails, pricing information, and internal communications. Screenshots shared as evidence suggest access to accounting or enterprise resource planning (ERP) systems, with directories organized by month. Among the compromised data is a "Contact Database" spreadsheet containing personal and business details of investors and partners across the US, UK, Singapore, and India. Additionally, internal store-level records such as manager names and contact numbers for multiple outlets were allegedly exposed. Everest has set a two-day deadline for McDonald’s India to respond, though the company has not issued a public statement. The incident underscores the ongoing threat posed by Everest, a ransomware group active since 2025, as it continues targeting high-profile organizations in 2026.

Everest Ransomware Gang Threatens to Leak 861GB of Stolen McDonald’s India Data The Russia-linked ransomware group Everest has claimed responsibility for a cyberattack on McDonald’s India, threatening to publicly release 861GB of stolen data if a ransom demand is not met. According to a dark web post dated January 20, the gang has set a countdown, with a full file list scheduled for release in two days and a complete data dump in nine days if negotiations fail. The group has already published sample data to validate its claims, including customer and employee personal information (names, emails, account IDs, demographics), internal financial reports, and operational documents some dating between 2017 and 2019. Researchers at Cybernews confirmed the authenticity of the samples but noted that the exposed data appears outdated. Everest, known for high-profile attacks, previously disrupted European airports in 2023 by targeting Collins Aerospace, a key provider of aviation systems. The gang has listed 337 victims since 2023, including major corporations. In this latest breach, the attackers allege they gained "long-term, unfettered access" to McDonald’s India’s systems, exfiltrating 131GB of customer records and 730GB of additional internal data. McDonald’s India has been contacted for verification but has not yet responded. If the data is leaked, the exposure could pose fraud and social engineering risks for affected individuals, while the release of financial and operational documents may provide competitors or criminals with sensitive corporate insights. The incident underscores the growing threat of ransomware groups targeting global brands with extortion tactics.

Everest Ransomware Group Claims Massive Data Breach at McDonald’s India The Everest ransomware group has alleged a major cyberattack on McDonald’s India, claiming to have exfiltrated 861 GB of sensitive data, including internal documents and customer personal information. The threat actors posted details of the breach on their dark web leak site on January 20, 2026, warning that the stolen data would be publicly released if McDonald’s fails to respond by a specified deadline. According to Everest, the compromised data includes a wide range of personal and corporate records, posing risks of identity theft and targeted phishing attacks. The group, a Russian-speaking operation active since December 2020, specializes in "pure extortion" stealing and selling data rather than solely encrypting files. Known for high-profile attacks, Everest’s recent victims include ASUS, Nissan Motor Corporation (900 GB stolen in January 2026), and Dublin Airport (1.5 million passenger records breached in October 2025). McDonald’s India, which operates through Connaught Plaza Restaurants (North/East India) and Hardcastle Restaurants (West/South India), has not yet confirmed the breach. The incident adds to the company’s history of cybersecurity challenges in the region, following previous data security issues in 2017 and 2024. The full scope and impact of the breach remain under investigation.