Point Robotics Data Breach

Point Robotics, a United States-based technology company, was listed as a victim on the dark-web leak site of the Everest ransomware group on October 27, 2026. Everest claims unauthorized access and data exfiltration, and the listing indicates that ransom negotiations did not result in payment. A US robotics company represents an attractive target for extortion activity: organizations in this sector hold high-value intellectual property, and the competitive and market value of stolen robotics IP extends beyond the immediate ransom event. SOCRadar identified the listing through its dark-web monitoring of threat actor leak sites. The listing fits Everest’s documented targeting pattern. Over the past 60 days, Everest has recorded 34 victims, with the United States as its most frequently targeted country. Technology is one of Everest’s three highest-volume sectors, alongside Professional Services and Manufacturing, placing a US robotics company squarely on-profile. The group’s operational model is double extortion: encrypting systems while exfiltrating data, maximizing leverage against victims who might otherwise restore from backups. This approach aligns directly with the circumstances described in the Point Robotics listing, which cites both unauthorized access and data exfiltration.

SOCRadar’s infostealer pipeline queried pointrobotics[.]com and returned zero records. No employee credentials, session tokens, or corporate authentication data surfaced in the queried dataset. However, this zero-result outcome does not confirm a clean security posture. Password reuse against exposed services, phishing, and direct exploitation of internet-facing systems are all initial-access vectors that do not leave a stealer-log footprint, meaning the absence of credential records cannot be treated as evidence that no compromise occurred. The listing fits Everest’s documented targeting profile: a US technology firm with high-IP value, targeted under a double-extortion model. Intellectual property from a robotics company carries competitive and market value beyond the immediate ransom event. In this context, the absence of stealer-log data is not exculpatory. Infostealer-harvested credentials frequently feed ransomware operations through initial access brokers and underground marketplaces, where corporate account access to Microsoft 365, VPNs, and remote-access portals can be validated and sold; however, no evidence currently ties this specific access path to the Point Robotics incident, and other vectors remain equally plausible. Organizations in the robotics and automation space that share technology partnerships, API integrations, or customer-data pipelines with Point Robotics should verify vendor access controls and monitor SOCRadar’s threat-intelligence feeds for exfiltrated data appearing in underground markets. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks, and multi-factor authentication review remain prudent given the possibility that credentials may exist under alternate corporate domains or in feeds outside the queried dataset. SOCRadar will update this report as the scope of the compromise is clarified.