Ransomware group aurora hits Estrategias BigMat S.L.U.
Estrategias BigMat S.L.U. — a retail & e-commerce target operating in ES has been listed by the aurora ransomware group on 2026-10-14. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Estrategias BigMat S.L.U. |
|---|---|
| Threat Group | aurora |
| Summary | [distribution] Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a French cooperative and one of Europe's largest building materials distribution networks. 624 SEPA payroll XML files (2022–2025) — every monthly salary payment for 300–500 employees across 15+ entities, with full names, DNI/NIE numbers, IBANs, and exact euro amounts. 20 SILTRA Social Security databases — the complete filing history for every subsidiary's workforce, containing números de afiliación, contribution bases, and employment records. <redacted> 2,690 customer loyalty cards with DNI/NIF identifiers — the entire customer-identity database. 888 Modelo 347 tax notifications — annual declarations to the Agencia Tributaria naming customers and suppliers with their DNI and transaction amounts. Complete financial records — 5 years of accounting journals, bank reconciliations, insurance policies, loan agreements, and invoices. Occupational health data (PRL) for 12+ subsidiaries — workplace injury reports, medical certificates, and risk assessments. |
| Date of Breach | 2026-10-14 |
| Discovery Date | 2026-10-14 |
| Region | ES |
| Target Domain | Estrategias BigMat S.L.U. |
| Business Sector | Retail & E-Commerce |
| Severity | MEDIUM |
Claim by aurora
[distribution] Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a French cooperative and one of Europe's largest building materials distribution networks. 624 SEPA payroll XML files (2022–2025) — every monthly salary payment for 300–500 employees across 15+ entities, with full names, DNI/NIE numbers, IBANs, and exact euro amounts. 20 SILTRA Social Security databases — the complete filing history for every subsidiary's workforce, containing números de afiliación, contribution bases, and employment records. <redacted> 2,690 customer loyalty cards with DNI/NIF identifiers — the entire customer-identity database. 888 Modelo 347 tax notifications — annual declarations to the Agencia Tributaria naming customers and suppliers with their DNI and transaction amounts. Complete financial records — 5 years of accounting journals, bank reconciliations, insurance policies, loan agreements, and invoices. Occupational health data (PRL) for 12+ subsidiaries — workplace injury reports, medical certificates, and risk assessments.
Posted by the aurora threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
Estrategias BigMat S.L.U.
Leak post (onion / Tor)
http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/estrategias-bigmat-slu-86da2d8a
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.