Russia-linked hackers nab highly sensitive Bolttech data, demand ransom

Everest Ransomware claims to have intercepted around 186GB of data from Bolttech, a global insurance infrastructure platform. The threat actor is demanding a ransom payment from the company.

According to what Everest posted on its leak site on the dark web, the data it has nabbed is highly sensitive.

“We are in possession of highly sensitive data, including employee and agent accounts (emails, names, roles, identifiers), customer information, contact details, policy data, mortgage-related records, phone numbers, email addresses, insured property addresses, financial parameters, and internal operational identifiers,” the gang claims.

To support the claims, the gang posted photo samples. There’s also a timer and an explanation that the data will be published unless Everest hears back from Bolttech later this week.

Cybernews has reached out to the company for confirmation and will update the story once a response is received.

However, the risk of Bolttech’s data being misused is serious, said the Cybernews research team after investigating the data samples.

“Customer, employee PII, policy identifiers could result in phishing, identity profiling for the affected people. Policy IDs can also be used to file fraudulent claims to customer support,” our researchers explained.

It’s so far difficult to say whether full addresses are present in the database. But if they are, the risk of doxxing is even bigger, added the research team.

The Bolttech platform, launched in 2020, connects carriers, brokers, and tech platforms to enable the digital distribution of insurance policies. Its insurance exchange is transacting over $5 billion in annual gross written premiums and connecting over 150 carriers.

This past summer, Bolttech closed a $147 million Series C round of funding at a $2.1 billion valuation. The Singapore-based firm generates approximately $1.5 billion in annual revenue.

Everest has victimized over 100 organizations in the past 12 months, making it one of the most notorious cybercrime cartels currently operating.

Everest is one of the most aggressive ransomware groups in operation today. It recently targeted Brazilian petroleum giant Petrobras and Under Armour, the global activewear and footwear brand.

The ransomware gang, believed to be Russia-linked, was first identified in 2021. It made headlines after the October 2022 attack on the American telecommunications behemoth AT&T. At the time, Everest said it had access to AT&T’s entire corporate network.

According to Cybernews’ dark web monitoring tool, Ransomlooker, Everest has victimized over 100 organizations in the past 12 months, making it one of the most notorious cybercrime cartels currently operating.

Unlock more exclusive Cybernews content on YouTube.