Morula IVF Ransomware Claim by Everest (Sep 2026)

Claim Summary

On or around September 25, 2026, the ransomware group tracked as “everest” allegedly listed Morula IVF on its dark web leak site. Morula IVF is a network of fertility clinics operating primarily in Indonesia, offering in vitro fertilization (IVF), fertility consultations, and assisted reproductive services.

According to the threat actor’s claim, the organization was added to the group’s victim roster on the stated attack date. The listing provides no disclosed data volume, no sample files, and no proof-of-compromise artifacts that Yazoul Security has been able to review. The claim remains entirely unverified.

Notably, the victim metadata lists the country as “ZA” (South Africa), while the organization’s domain (morulaivf.co.id) and described operations point to Indonesia. This kind of inconsistency is common in leak site metadata and should not be treated as reliable.

Threat Actor Profile

The group operating as everest is a relatively low-profile ransomware operation. At the time of writing, Yazoul Security has no confirmed public research references, no documented tooling inventory, and no reliable victim count for this actor. Its total known victim count is listed as unknown.

Because so little is independently documented about everest, credibility assessment is difficult. Groups with thin public track records sometimes:

• Rebrand from other operations to shed notoriety
• Post exaggerated or recycled claims to attract attention
• List victims without genuine access, hoping for quick payment

Conversely, low-profile groups can also be genuinely capable but simply underreported. Without corroborating evidence such as leaked file samples, negotiation chatter, or victim confirmation, neither scenario can be confirmed. Treat everest’s claims with heightened skepticism until more is known.

No YARA rules or detection signatures specific to this group are currently available in our intelligence set. Analysts should rely on generic ransomware detection guidance, including monitoring for mass file encryption behavior, unusual lateral movement, and exfiltration patterns.

Alleged Data Exposure

The leak site entry does not specify a data volume. The accompanying description appears to be AI-generated summary text about Morula IVF’s business, not evidence of exfiltrated data. No sample documents, patient records, or file trees have been published in connection with this claim as of this writing.

For a healthcare and reproductive medicine provider, any genuine breach could involve highly sensitive categories of information, including patient identities, medical histories, and fertility treatment records. However, at this stage there is no verified indication that any such data was accessed or exfiltrated.

Potential Impact

If the claim is accurate, potential impacts could include:

• Regulatory exposure under Indonesian personal data protection law
• Reputational harm given the sensitive nature of fertility care
• Possible patient notification obligations
• Operational disruption if systems were encrypted

None of these outcomes are confirmed. Ransomware groups frequently overstate impact to pressure victims into paying.

What to Watch For

• Publication of verifiable data samples by the group
• A formal statement from Morula IVF or its parent organization
• Regulatory filings or breach notifications in Indonesia
• Independent forensic reporting
• Changes to or removal of the leak site entry, which sometimes signals negotiation

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Yazoul Security has NOT independently confirmed the attack, the data exposure, or any details described above. All statements attributed to the threat actor are allegations only. Ransomware operators routinely exaggerate or fabricate claims. Readers should await confirmation from Morula IVF or authoritative investigators before drawing conclusions. For related coverage, see our /news/ section.