SleepEx LabRetriever Data Breach

Everest added SleepEx LabRetriever to its dark-web data-leak site on October 27, 2026, claiming to have exfiltrated data from the organization. The listing was identified through SOCRadar’s dark-web monitoring of the group’s leak site. The victim appears to operate in the Healthcare sector, although its country of registration is not confirmed in the available data. Public naming of the victim signals that ransom negotiations stalled or concluded without payment. The targeting fits a broader pattern in which medical and life-science organizations remain a standing ransomware target: time-sensitive data and regulatory exposure drive rapid settlement decisions, making healthcare victims persistently attractive to extortion-focused groups. The listing is consistent with Everest’s recent operational tempo. Over the past 60 days, the group recorded 34 victims, with Technology, Professional Services, and Manufacturing as its primary sectors, although Healthcare appears consistently among its targets. The group’s most frequent victim geographies are the United States, Japan, and Italy. While SleepEx LabRetriever sits outside Everest’s top three sectors by volume, the group’s repeated appearances in Healthcare mean the claim does not represent a departure from its typical targeting pattern, and the incident aligns with the sector-level risk the group poses to medical and life-science organizations.

SleepEx LabRetriever had no domain recorded in the victim entry, leaving SOCRadar’s infostealer pipeline without a query target. Because of this, confirming whether credentials belonging to the organization circulated in stealer-log collections is not possible from the available data. This gap should not be interpreted as evidence that the organization is unaffected: without a queryable corporate domain, no telemetry conclusion can be drawn in either direction, and any exposed credentials would remain invisible to this check. The absence of a telemetry result therefore leaves the credential-exposure question entirely open. Everest’s known initial-access vectors include phishing, exposed RDP endpoints, and credential stuffing against VPN portals. These paths can yield valid credentials or direct access to externally facing services, which may serve as the entry point for the intrusion and the data exfiltration the group claims, although the specific method used against SleepEx LabRetriever has not been confirmed and should be treated as an open question rather than an established fact. All of these vectors warrant auditing on any externally facing authentication surface. Healthcare organizations face compounding liability when ransomware intersects with exfiltration: HIPAA and GDPR can each trigger penalty exposure independent of ransom outcomes. Any organization sharing vendors, systems, or patient-data pipelines with SleepEx LabRetriever should initiate incident-response evaluation without delay. Supported actions include auditing all externally facing authentication surfaces — particularly VPN portals and RDP endpoints — for exposure to phishing and credential stuffing, and maintaining continued dark-web monitoring of Everest’s activity. SOCRadar continues to monitor Everest and will publish updates as the scope of this incident becomes clearer.