Aupaircare and Intraxinc Listed by everest Ransomware Group

On August 29, 2025, the Everest ransomware group added both AuPairCare and its sister company Intrax Inc. to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack on the organizations that match thousands of American families with international au pairs and manage cultural exchange programs.

Reported Details of the Incident

Public reporting indicates the two companies were listed together on the Everest leak site hosted on the dark web. AuPairCare provides live-in childcare for host families across more than 40 states, while Intrax Inc. operates a range of international exchange programs for work, internships, teaching, and language learning. The listing states that internal files were stolen, although the precise number of affected individuals remains unknown at this time. No sample data has been publicly released by the group as of the listing date, and the companies have not yet issued detailed public statements on the volume or exact nature of the records involved.

Why This Matters for You and Your Family

If you have ever used AuPairCare to bring an au pair into your home or participated in any Intrax exchange program, your personal information may now sit in a ransomware operator’s hands. Host family records, contact details, payment information, and correspondence with international participants are the kinds of documents typically stored by these agencies. A breach of this type can expose names, addresses, phone numbers, email accounts, and financial details that criminals can use for identity theft, phishing, or targeted scams against you and your children. Even if you are not certain whether your records were included, the uncertainty itself creates stress—especially for families who shared sensitive information about minors or overseas visitors.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. Criminals frequently cross-reference stolen data with other breaches to build detailed profiles. An email address allegedly leaked from AuPairCare can be linked to your social-media handles, your children’s gaming accounts, or school-related logins. Once these connections are mapped, attackers can launch doxxing campaigns, harass family members, or sell the compiled dossier on underground markets. Credential leaks like this one often cascade into account takeovers precisely because the same password or security question is reused across services. Gaming accounts belonging to your children are especially vulnerable because they frequently tie back to a shared family email or phone number, turning a single breach into a gateway for broader identity exposure.

Everest Ransomware Group’s Track Record

Public reporting attributes the Everest ransomware operation to a group that emerged in 2023. The gang has targeted organizations across healthcare, education, and service sectors, with notable prior victims including various U.S. businesses whose internal documents appeared on the same leak site. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration before encryption. They then demand payment and, if unpaid, publish stolen files on their onion site while applying pressure through direct contact or data samples. The group’s listing of AuPairCare and Intrax Inc. fits this pattern of public extortion following unsuccessful ransom negotiations.

What to Do

• Rotate any password you ever used with AuPairCare or Intrax Inc. and enable 2FA through an authenticator app on every account where that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, followed by cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same family address or email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing day-to-day accounts.

The incident underscores that even organizations trusted with family arrangements can become targets, leaving ordinary households exposed long after the initial breach. One practical forward step is to treat every potential leak as the start of an identity chain rather than an isolated event. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts. Starting that process now can limit the damage from both this leak and the ones that will inevitably follow.