Ransomware group aurora hits Allmand-Smith Limited
Allmand-Smith Limited — a manufacturing target operating in GB has been listed by the aurora ransomware group on 2026-10-21. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Allmand-Smith Limited |
|---|---|
| Threat Group | aurora |
| Summary | Allmand-Smith Limited, a manufacturing organization in the United Kingdom, was listed by the aurora ransomware group on its leak site on 2026-10-21. |
| Date of Breach | 2026-10-21 |
| Discovery Date | 2026-10-21 |
| Region | GB |
| Target Domain | Allmand-Smith Limited |
| Business Sector | Manufacturing |
| Severity | MEDIUM |
Claim by aurora
[distributor, manufacturer] Allmand-Smith Limited (trading as Stormguard) — a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent. Domain admin credentials in plaintext and a full DC dump — STORMGUARD\MichaelAdmin / 5t0rmGuard Complete NatWest banking infrastructure — blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage 200 AR/AP containing bank details for every customer and supplier across all 15 entities. NatWest has 3 outstanding registered charges (Jun 2026). Full payroll for every employee, current and former — Payroll.zip (6.1 GB, 1,185 files) from Sage Payroll: NI numbers (lifetime identifiers), tax codes, PAYE history, gross/net pay per period, bank account details for BACS salary payments, pension contributions, P45/P60 records. Complete financial records for 15 entities — Sage 200 databases for Allmand-Smith Ltd, Stormguard Fabrications, Stormguard Sills, Rainwater Systems, Floodplan, Bridgemill, Chelford, Paradise, MJ Associates, SAS Partners, Specialised Aluminium Supplies, two pension funds, plus the consolidated age200_AllmandSmithLtd.bak (2.1 GB). Management accounts (Jan–Jul 2024), nominal trial balances, bank reconciliations (£102,662 cash at year-end). Revenue: £17.66M, profit: £1.01M, financial health: 12/100 (distressed).
Posted by the aurora threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
Allmand-Smith Limited
Leak post (onion / Tor)
http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/allmand-smith-limited-64870e71
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.