McDonald’s India Faces Ransomware Attack: Everest Group Threatens Data Leak

Last Updated: January 22, 2026By

Hackers Claim McDonald’s Data Breach

A ransomware group, known for its bold attacks, has reportedly stolen nearly a terabyte of data from McDonald’s operations in India. They’re planning to leak this information shortly. With connections to Russia and a history of targeting European airports, the group has now turned its attention to McDonald’s. This represents a significant escalation in their list of targets.

On January 20, a message on a dark web forum from the Everest Group threatened to release data related to McDonald’s local businesses. They’ve allegedly obtained around 861GB of sensitive data, including what they claim are customer files and internal documents.

This tactic—revealing victims’ names publicly—is common in extortion schemes, designed to pressure companies into paying ransoms. Without an agreement, groups often sell or publicly release stolen data, tarnishing reputations.

The group has set a countdown: two days until the release of a list of stolen information and nine days for full disclosure, stirring memories of their attack on Coca-Cola. While Cybernews researchers found most of the data to be outdated, its exposure still poses serious risks of fraud and social engineering attacks.

Everest Group’s Well-Documented History

The Everest Group is notorious in the ransomware landscape. Cybernews’ Ransomlooker tool highlights their attacks on 337 entities since 2023, including high-profile names.

Last year, the group disrupted the aviation sector, notably attacking Air Miles España with a 131GB data breach. They accessed sensitive customer information, causing significant alarm.

The group’s ventures didn’t stop there. They’ve interfered with the Spanish airline Iberia, hijacking customer bookings, and targeted Collins Aerospace, affecting European airports. By seizing the MUSE check-in software, they caused severe operational halts.

Eventually, 23GB of data belonging to Collins Aerospace appeared on the dark web. As the story develops, stay informed about the latest on this situation.

**Stay vigilant. Protect your data. For more cybersecurity insights, check out Qsentinel.**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.

Get daily news in your inbox

The lastest on Hacks, ransomware attacks, post quantum security and more