Everest Just Listed Frost Bank and Citizens Financial Group on Its Dark Web Leak Site. The Banks Say the Breach Came From a Third-Party Vendor. ZeroFox Analysis Suggests Everest Hit One Vendor and Cascaded Into Both Banks Plus an Aircraft Manufacturer, an Indonesian E-Commerce Firm, and Multiple Others. The Data Dump Is Scheduled for April 25.

WHAT EVEREST CLAIMS

The Everest ransomware gang posted both banks on its dark web leak site on April 20 with sample data and a six-day public release countdown. The samples released for each bank tell different stories.

The Frost Bank sample contains approximately 250,000 records with a serious data profile. Social Security numbers. Taxpayer identification numbers. Full legal names. Mortgage interest rates. Investment profits. Income data. Taxable amounts. Home addresses. This combination is a near-complete toolkit for identity theft, tax fraud, and targeted financial social engineering. The Daily Dark Web also reported unencrypted credit card authorization forms containing full card numbers, CVV codes, expiration dates, and billing addresses in the broader Everest dump this cycle.

The Citizens Financial Group sample is larger in volume but narrower in sensitivity. Everest claims 3.4 million records from a SQL database dump. The sample content observed in public reporting contains full names, home addresses, account numbers, and internal document flags. No Social Security numbers or taxpayer identification numbers were found in the public sample. Citizens has described its exposed data as "masked test data including limited customer information," which aligns with the observed sample content.

THE VENDOR ANGLE

Both banks confirmed a breach and both banks said the intrusion did not touch their own networks. The compromise originated with a third-party vendor that handles data processing work for both institutions. Neither bank has publicly named the vendor.

The key analysis here comes from ZeroFox, which shared its assessment with American Banker on April 22. ZeroFox's position is that the simultaneous leak posting combined with similar document-production data formats in both samples points to a shared vendor compromise rather than two unrelated attacks. When the same attacker drops two different banks on the same day with data that looks like it came through the same processing pipeline, the most likely explanation is that the attacker hit one vendor and exfiltrated data the vendor was holding on behalf of multiple banking clients.

The broader Everest disclosure cycle supports this framing. Alongside the banks, Everest listed Tokoparts (an Indonesian e-commerce auto parts company), Complete Aircraft Group (a U.S. aviation services firm), Umiles, and Nutrabio. The data types reported across the cycle include aviation maintenance records, engine borescope inspection videos, employee and pilot data, corporate email archives, and operational workflow screen recordings. This is not a thematic portfolio of targets a single threat group would assemble through direct compromise of each victim. This is what a vendor-compromise dump looks like when the vendor serves customers across multiple verticals.

WHY THIS PATTERN KEEPS HAPPENING

The vendor-compromise ransomware pattern is not new and we have covered it extensively in the past two months. In April we tracked the Anodot/Snowflake integration breach that cascaded into Rockstar Games and produced the ShinyHunters 78 million record leak. In March we covered the Axios JavaScript supply chain attack that hit OpenAI's macOS application signing infrastructure. Before that, Trivy, the vulnerability scanner maintained by Aqua Security, was compromised by a group called TeamPCP that deployed the SANDCLOCK credential stealer across five downstream ecosystems. The Smart Slider 3 WordPress plugin compromise gave attackers access to 800,000 WordPress sites through a single plugin. CPUID's download infrastructure was hijacked and used to serve malware to users downloading CPU-Z and HWMonitor.

Each of these follows the same architecture. A service provider, a software vendor, a plugin maintainer, or a data processor gets compromised. The compromise multiplies across the provider's customer base because the customers trusted the vendor with sensitive data, credentials, or execution context. The individual customers are breached without being directly attacked. They find out when their data shows up on a leak site or when the vendor notifies them.

The Frost and Citizens disclosures fit this pattern exactly. Neither bank was directly attacked. Both have real incident response work to do anyway because their customers' data is headed to the public web on Saturday regardless of whether the banks' own defenses held.

THE ATTACKER

Everest has been active since at least 2020 and runs a classic double-extortion ransomware-as-a-service operation. Russia-linked infrastructure. Affiliate-based structure where operators handle the intrusion and exfiltration while the Everest administrators provide the ransomware, leak site, and extortion portal in exchange for a cut of the ransom.

Previous Everest victims include Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW. This is not a low-tier gang testing their capabilities against soft targets. Everest targets large brand names with significant data volumes, and the April 2026 disclosure cycle is consistent with their established targeting pattern.

The six-day release deadline is standard Everest extortion procedure. It serves two purposes. It creates external pressure on the victim organizations to negotiate or pay. It also serves as proof-of-work for Everest's next set of victims, demonstrating that the group follows through on threats when payment is not received.

INDICATORS AND CONTEXT

WHAT ORGANIZATIONS SHOULD DO