Ransomware group aurora hits Ernesto Malvestiti S.p.A.
Ernesto Malvestiti S.p.A. — a manufacturing target operating in IT has been listed by the aurora ransomware group on 2026-10-26. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Ernesto Malvestiti S.p.A. |
|---|---|
| Threat Group | aurora |
| Summary | Ernesto Malvestiti S.p.A., a manufacturing organization in Italy, was listed by the aurora ransomware group on its leak site on 2026-10-26. |
| Date of Breach | 2026-10-26 |
| Discovery Date | 2026-10-26 |
| Region | IT |
| Target Domain | Ernesto Malvestiti S.p.A. |
| Business Sector | Manufacturing |
| Severity | MEDIUM |
Claim by aurora
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM. The exposed material spans the company's entire operations: PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB ×5). GDPR Article 9 special-category data — medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce. 50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more. SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export. ADP payroll SFTP credentials stored in WinSCP.ini — the channel used to transmit employee salary data to the external payroll processor. 614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships. 1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts. 160+ client/supplier contracts with pricing, commercial terms, and executed NDAs. 560+ job candidate CVs with full names, addresses, phone numbers, and career histories.
Posted by the aurora threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
Ernesto Malvestiti S.p.A.
Leak post (onion / Tor)
http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/ernesto-malvestiti-spa-5630b059
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.