The Everest extortion crew has claimed two medical technology manufacturers on the same day, adding a Norwegian training-equipment maker and a Japanese eye-care imaging vendor to its leak site.
Threat trackers logged the Everest listings of Laerdal Medical and Topcon Healthcare within one minute of each other on October 13, and ransomware.live classified both as healthcare victims. Coordinated same-day posts are a common Everest tactic to pressure multiple targets at once.
Laerdal, headquartered in Stavanger, builds patient simulators, manikins, and resuscitation training tools used by hospitals, emergency services, and medical schools worldwide. Topcon Healthcare, a subsidiary of Japan’s Topcon Corporation, supplies ophthalmic diagnostic imaging devices, vision screening systems, and eye-care software to clinics and health systems.
Neither claim has been independently confirmed, and no data has been published. Leak-site posts are threats rather than proof, and Everest has cycled through repeated healthcare claims in recent months. Still, the pairing matters for supply-chain risk: medical training and imaging platforms often sit inside clinical networks and integrate with electronic records.
Hospitals that buy simulation gear or eye-imaging equipment should treat vendor claims as a prompt to review third-party exposure, confirm which of their own systems interface with those suppliers, and check for unusual authentication activity tied to vendor accounts. Device makers themselves are increasingly targeted because a single compromise can reach the hospitals that depend on them.
Healthcare procurement teams should also ask suppliers for breach-notification terms and for confirmation of which customer data they hold, since a vendor intrusion can expose protected health information without the provider ever being directly attacked.
