Burris & MacOmber Data Breach

The Everest ransomware group listed Burris & MacOmber on its dark-web extortion site on October 27, 2026, claiming unauthorized access and data exfiltration against the professional services firm. The country of registration for Burris & MacOmber is not confirmed in the available listing data. The publication of the victim entry signals that negotiations between the group and the firm have failed or hit an impasse, moving the extortion pressure into the public domain. As a professional services firm, Burris & MacOmber fits a category of organizations that aggregate sensitive legal, financial, and strategic data belonging to multiple client organizations, which multiplies the extortion leverage available to threat actors. Everest has claimed 34 victims in the past 60 days, demonstrating sustained and active operations. Professional Services ranks among its three most targeted verticals, alongside Technology and Manufacturing. The group’s most frequently hit geographies are the United States, Japan, and Italy, though its campaigns are globally distributed. The listing of Burris & MacOmber aligns closely with Everest’s demonstrated targeting pattern, as the professional services sector reflects a straightforward rationale for the group: these firms hold privileged data spanning many client organizations, so a single compromise can yield extortion leverage against multiple downstream parties.

Burris & MacOmber had no domain recorded in the victim entry, which means SOCRadar’s infostealer telemetry pipeline had no domain to query. As a result, whether employee credentials circulated in stealer-log markets before the leak-site listing cannot be determined from available data. This absence of a queryable record does not confirm that the organization is unaffected; it simply reflects a limitation of the telemetry in this case. Professional services firms are frequent targets of business email compromise and spear-phishing, and infostealer-harvested credentials from such campaigns can potentially support broader intrusion paths, including corporate account access and ransomware deployment, though no such access method is confirmed for this incident. Given this sector risk, phishing-resistant multi-factor authentication and continuous credential monitoring are baseline controls for any firm operating in professional services. Organizations should maintain dark web and stealer-log monitoring and perform proactive credential-hygiene checks, including password rotation and multi-factor authentication review, to reduce the risk that exposed credentials could be validated and leveraged for corporate access. SOCRadar will continue tracking Everest and update this entry as the scope of the incident is clarified. Clients and counterparties of Burris & MacOmber face secondary exposure if their confidential legal, financial, or strategic records were among the data Everest claims to have exfiltrated. Organizations with data-sharing or privileged-access arrangements with the firm should assess whether applicable notification obligations are triggered. Because the full scope of the claimed exfiltration has not yet been clarified, affected parties should monitor for updates as additional information becomes available.