ASRock Rack and ASUS: Exclusive: ASRock Rack allegedly breached, data leak could lead to further breaches

ASRock Rack Hit by Everest Ransomware Gang, 509GB of Sensitive Data Allegedly Stolen

ASRock Rack, the enterprise-focused server and cloud hardware division of ASRock, has been listed on the dark web leak site of the Everest ransomware gang. The threat actors claim to have exfiltrated a 509GB database containing confidential technical documentation, firmware, software, BIOS files, diagnostic tools, baseboard management controller (BMC) firmware, drivers, and utilities.

Everest warned that unauthorized access to the stolen data could enable attackers to exploit vulnerabilities in hardware and software systems, potentially compromising devices at scale. The group also highlighted broader risks, including reputational damage, legal consequences, and the loss of intellectual property, which could strengthen competitors.

Security experts, including Rapid7’s Christiaan Beek, noted that if the claims are accurate, the breach could have supply chain implications. Firmware and BIOS-related materials operate below the operating system, making vulnerabilities harder to detect and remediate. The incident raises concerns about follow-on attacks, such as malicious repackaging of drivers or firmware updates, and the possibility of state-aligned involvement given the strategic value of the target.

Everest provided a data sample on its leak site, including screenshots of file trees with keywords like data centre and diag, aligning with their claims. The group has set a deadline of approximately nine days to publish the full dataset but has not disclosed a ransom demand.

This breach follows Everest’s recent attack on an ASUS supplier, which the company confirmed involved the theft of camera source code for ASUS phones. While ASUS stated the incident did not affect its products or internal systems, Everest later expanded its claims, alleging the theft of a one-terabyte database containing data from ASUS, ArcSoft, and Qualcomm.

Source: https://www.cyberdaily.au/security/13120-exclusive-asrock-rack-allegedly-breached-data-leak-could-lead-to-further-breaches

ASRock Rack Inc. cybersecurity rating report: https://www.rankiteo.com/company/asrock-rack

ASUS cybersecurity rating report: https://www.rankiteo.com/company/asus

"id": "ASRASU1769030696",
"linkid": "asrock-rack, asus",
"type": "Ransomware",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology, Server and Cloud Hardware',
                        'name': 'ASRock Rack',
                        'type': 'Enterprise hardware division'}],
 'data_breach': {'data_exfiltration': 'Yes',
                 'sensitivity_of_data': 'High (confidential, intellectual '
                                        'property)',
                 'type_of_data_compromised': ['Technical documentation',
                                              'Firmware',
                                              'Software',
                                              'BIOS files',
                                              'Diagnostic tools',
                                              'BMC firmware',
                                              'Drivers',
                                              'Utilities']},
 'description': 'ASRock Rack, the enterprise-focused server and cloud hardware '
                'division of ASRock, has been listed on the dark web leak site '
                'of the Everest ransomware gang. The threat actors claim to '
                'have exfiltrated a 509GB database containing confidential '
                'technical documentation, firmware, software, BIOS files, '
                'diagnostic tools, baseboard management controller (BMC) '
                'firmware, drivers, and utilities. Everest warned that '
                'unauthorized access to the stolen data could enable attackers '
                'to exploit vulnerabilities in hardware and software systems, '
                'potentially compromising devices at scale. The group also '
                'highlighted broader risks, including reputational damage, '
                'legal consequences, and the loss of intellectual property, '
                'which could strengthen competitors.',
 'impact': {'brand_reputation_impact': 'Reputational damage',
            'data_compromised': '509GB of sensitive data',
            'legal_liabilities': 'Legal consequences',
            'operational_impact': 'Potential exploitation of vulnerabilities '
                                  'in hardware and software systems'},
 'motivation': 'Financial gain, intellectual property theft',
 'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'Everest'},
 'references': [{'source': 'Everest ransomware gang leak site'},
                {'source': 'Rapid7 (Christiaan Beek)'}],
 'threat_actor': 'Everest ransomware gang',
 'title': 'ASRock Rack Hit by Everest Ransomware Gang, 509GB of Sensitive Data '
          'Allegedly Stolen',
 'type': 'Ransomware'}