Evidn

Summary

Evidn, a Queensland-based applied behavioural science firm that works closely with the Queensland government, was listed as a victim by the Everest ransomware gang on 9 January 2025. The attackers claimed to have stolen 50 gigabytes of data and gave the company a two-week countdown before threatening to publish the stolen information.

What Happened

The Everest ransomware group gained unauthorised access to Evidn's systems and exfiltrated 50 gigabytes of data. On 9 January 2025, the gang posted their claim on their dark web leak site, instructing company representatives to follow their instructions before a two-week deadline expired.

Evidn, based in Fortitude Valley, Queensland, provides applied behavioural science services including profiling and analysis, change programmes, and skills training. The company works extensively with the Queensland government and has engaged with over 1,300 stakeholders across 10 agricultural industries in Queensland, designing programmes for practice change, drought resilience, and sustainable farming.

Impact on Individuals

The breach primarily involved business records rather than personal information. However, given Evidn's work with government agencies and numerous stakeholders across Queensland's agricultural sector, the stolen data could include sensitive information about government programmes, stakeholder engagements, and behavioural research.

The company's client list includes the Great Barrier Reef Foundation, Wine Australia, Bundaberg Regional Council, as well as international clients such as the University of Virginia and Princeton University in the United States.

Organisational Response

Evidn has not publicly commented on the incident or disclosed details of their response. The company did not respond to media requests regarding the breach or whether they engaged with the ransomware operators. +++