Everest ransomware group lists Topcon Healthcare and Laerdal Medical hours apart

The Everest ransomware group posted three new victims to its dark web leak site on October 13, and two make medical equipment. Topcon Healthcare, the Japan based eye care diagnostics arm of Topcon Corporation, and Laerdal Medical, the Norwegian maker of resuscitation training manikins and simulation gear, appeared within hours of each other, according to the tracking site Ransomware.live. The third listing, satellite communications firm KVH Industries, has no apparent medical tie.

Neither device maker has confirmed an intrusion. Everest's posts name no ransom figure and include no sample of the files it claims to hold, the usual gap that shows up before a company's own forensic review is finished. Breachsense logged the Laerdal claim at a 17 gigabyte leak size. The Topcon Healthcare listing carries no stated volume, and both companies face the same ultimatum: contact the group through the channels provided or watch the files post.

Everest has claimed 412 victims across 37 countries since surfacing in September 2021, and healthcare is its single most frequent target, with 68 prior claims ahead of professional services and manufacturing. The group's own leak site data puts the average gap between a first claim and a published leak at 12 days. Twelve days is the clock to start the moment a listing like this names your company, because waiting on the vendor to confirm burns exactly the runway available to prepare.

Questions & Answers

Did Everest ransomware breach Topcon Healthcare?

Not confirmed. Everest posted an unconfirmed claim against Topcon Healthcare, the eye care diagnostics subsidiary of Topcon Corporation, to its leak site on October 13, 2026, with no ransom amount and no published data sample.

What company makes the resuscitation training manikins hit by Everest ransomware?

Laerdal Medical, a Norwegian maker of medical simulation and resuscitation training equipment, which Everest listed as a victim on October 13, 2026. Breachsense recorded the claimed leak at 17 gigabytes, and Laerdal has not confirmed an intrusion.

How many victims has the Everest ransomware group claimed as of October 2026?

412 victims across 37 countries since the group surfaced in September 2021, with healthcare its most frequent target at 68 prior claims, more than professional services or manufacturing.

← Back to Threat Intel