Iron Mountain 36GB Data Leak of Client Documents by Everest Group

Data Breach Overview

In early February 2026, the ransomware and extortion collective Everest Group publicly claimed it had accessed and leaked approximately 36 GB of data from Iron Mountain Inc., a U.S.–based enterprise information management and data storage company. Everest posted the alleged leak and extortion demand on its dark-web leak site, asserting the data contained “personal documents and information of clients.”

Iron Mountain, headquartered in Portsmouth, New Hampshire and serving hundreds of thousands of customers worldwide, responded that the incident stemmed from unauthorized access to a limited portion of its environment and that its core infrastructure was not breached.
(Iron Mountain is a global information management company providing records management, secure data storage, and related services.)

---

Details of the Leak

• Threat Actor: The Everest ransomware group — a cybercrime collective known for data theft and extortion tactics.
• Claimed Data Volume: Everest alleged access to about 36 GB of files containing client documents and personal information.
• Method: According to reports, attackers used compromised credentials to reach a publicly accessible folder on a file-sharing platform.
• Content: The group claims that the stolen data includes internal documents and client-related information, though no full dataset has been publicly released by the attackers.

---

Company Statement and Impact

Iron Mountain issued a statement confirming the unauthorized access but emphasized the breach’s limited scope. The company reported that only a single, external folder used for sharing marketing and vendor materials was accessed, that no ransomware or malware was deployed, and that no core systems or broader internal networks were affected.

Risk and Exposure

If the attackers’ claims of client data exposure are accurate, there could be risks such as:

• Phishing and social engineering attacks targeting individuals or organizations whose information was included.
• Reputational impacts for Iron Mountain due to perceived security gaps.

However, Iron Mountain’s official assessment suggests that the breach was limited and that customer-sensitive data remains secure.

---

Company Data Breach History

As of this incident, there are no widely reported or confirmed historical breaches of Iron Mountain’s systems involving large-scale customer data exposure. The company’s public statement contests the severity of the current claims.

---

Recommendations for Affected Parties

• Change passwords and enable multi-factor authentication (MFA) on all accounts.
• Monitor communications for unusual or phishing-style messages.
• Stay aware of any official updates from Iron Mountain regarding further investigation.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.