Rezayat Group, a major industrial services provider based in Saudi Arabia, has appeared on a dark web leak site. Hackers claim to have obtained several gigabytes of the company’s data.
The Everest ransomware group is allegedly responsible for the attack. Rezayat, which operates 25 companies across sectors such as engineering, manufacturing, and logistics, was added to the gang’s leak site that showcases its most recent victims.
Cybernews research team reviewed a sample of the leaked data posted by the attackers. The sample included screenshots showing what appear to be reports and contracts with Rezayat’s clients, along with technical drawings related to industrial projects. According to the team, this exposure could damage Rezayat’s business relationships and open the door to supply chain attacks.
The attackers claim to have exfiltrated 10 gigabytes of data, though this figure cannot be confirmed based on the limited number of screenshots provided. Ransomware groups often release small samples of stolen data as leverage to pressure victims into paying a ransom, threatening further leaks if demands are not met.
Rezayat is headquartered in Saudi Arabia and operates in 13 countries through its 25 subsidiaries. The company employs more than 20,000 people globally.
The Everest ransomware group is believed to have ties to the Russia-linked BlackByte cartel. Active since 2021, Everest has been behind several high-profile attacks. In May 2025, the group targeted major organizations including Mediclinic, a $5 billion healthcare company.
Everest often uses compromised user accounts and Remote Desktop Protocol (RDP) to move laterally across networks.
Cybersecurity experts warn that the Middle East is increasingly being targeted by cybercriminal groups, with Everest among those actively focusing on the region.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
