Kingston Technology has told reporters it is investigating claims that a cybercriminal group stole marketing material intended for Asia-Pacific customers, after the Everest ransomware group published details on a darknet leak site. The hardware and storage firm said it was aware of the claims and is looking into them, while continuing to operate normally.
What has been claimed
The Everest group posted what it says is a repository containing 9,438 files totalling 138.49 GB of data. According to the post, the material is largely marketing-related and covers product launches, localisation packages, retail and e-commerce assets, product imagery and other communications aimed at regional markets across the Asia-Pacific.
“We are aware of claims of a security event at Kingston, and are investigating these claims,” a Kingston spokesperson told Cyber Daily.
The group says the data set includes assets for numerous territories, naming Taiwan, Japan, Korea, Thailand, Vietnam, India, Australia, New Zealand, Malaysia and Singapore. It also asserts some of the content relates to Kingston’s HyperX gaming peripheral brand. The only direct evidence published by Everest so far is a screenshot of a Windows directory that appears to show folders named after Kingston employees.
Who is Everest and how credible is the claim?
Everest is a Russian-speaking ransomware actor active since 2021 that claims hundreds of victims. Security reporting and the group’s public postings indicate it uses a variety of initial access techniques, including exploiting weak or stolen credentials and abusing remote access tools. Everest has previously said it exfiltrated significant data from other PC hardware and server vendors, including a recent claim about technical data from Asrock Rack.
At this stage, independent verification of the Kingston claim is limited. The group has not published a ransom demand and has reportedly threatened to release the data within days. The visible artefacts shared by Everest are a directory screenshot and the descriptive listing of files; no full data sample or verifiable keys have been published by the group in the public post cited by reporting.
Immediate implications
For customers and channel partners, the central risks of a marketing-data breach include targeted phishing, credential harvesting attempts leveraging authentic-looking materials, and reputational harm. Marketing and launch collateral can be repurposed to create convincing social engineering campaigns.
Kingston’s brief public statement emphasises continuity of service. That is important: the difference between a compromised marketing repository and a full systems breach matters for supply-chain operations and product support. At present, the company has not reported disruption to services, nor confirmed unauthorised access to production systems or customer personal data.
- Claimed files: 9,438
- Claimed volume: 138.49 GB
- Regions named by Everest: Taiwan, Japan, Korea, Thailand, Vietnam, India, Australia, New Zealand, Malaysia, Singapore
| Item | Details |
|---|---|
| Files | 9,438 (claimed by Everest) |
| Data volume | 138.49 GB (claimed) |
| Content type | Marketing materials, product imagery, localisation, launch folders (claimed) |
Wider context and what to watch for
This allegation sits within a broader pattern of ransomware groups targeting technology manufacturers and suppliers. Attackers often seek intellectual property, go-to-market materials and technical documentation that can be monetised or used for secondary attacks. Corporate responses typically involve forensic investigation, engaging external incident responders, and notifying potentially affected partners while monitoring for proof that stolen material has been published.
Observers should look for several developments over the coming days: any sample data released by Everest that can be forensically validated; confirmation from Kingston about the nature and scope of any unauthorised access; and whether a ransom demand or publication timeline is announced on darknet channels. Security teams should heighten phishing awareness across reseller and partner networks while Kingston completes its investigation.
The company has not, at the time of the initial report, indicated that customer personal data or operational systems are affected. Until forensic findings are made public, the claim should be treated as an unverified but plausible incident in line with recent targeting trends against hardware and component vendors.
WE NEWS will continue to monitor official statements from Kingston and reporting from cybersecurity specialists for any confirmation of the breach and its potential impact.
