Everest Ransomware Says It Breached Brazilian Energy Giant Petrobras

Everest ransomware claims to have stolen over 180GB of seismic survey data from Petrobras, demanding contact through qTox with a countdown in place.

Everest ransomware group has listed two separate entries on its dark web leak site, both targeting Petrobras, a Brazilian majority state-owned multinational corporation giant in the petroleum industry headquartered in Rio de Janeiro.

Petrobras and SAExploration Data

Both listings were published on November 14, 2025. The first listing points to an alleged data breach involving both Petrobras and a partner firm, SAExploration. According to the group, it managed to steal a database that contains over 176 gigabytes of seismic navigation data. More than half of that, over 90 gigabytes, is said to belong directly to Petrobras.

The files, as per the group, contain highly detailed technical information, including ship positioning, equipment configurations, hydrophone readings, and depth measurements. There are also quality control documents, metadata, and processed reports ...