Ransomware group aurora hits Pyramid Analytics B.V.
Pyramid Analytics B.V. — a technology target operating in NL has been listed by the aurora ransomware group on 2026-07-30. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Pyramid Analytics B.V. |
|---|---|
| Threat Group | aurora |
| Summary | [analytics] Pyramid Analytics B.V. — a decision-intelligence platform company headquartered in Amsterdam, acquired by ServiceNow (NYSE: NOW) for hundreds of millions of dollars just four months earlier. We obtained the complete source code of the Pyramid Decision Intelligence Platform along with: 10+ copies of the platform source code with full Git history, revealing every feature, algorithm, security module, and AI integration ever built. <censored> <censored> 22 GB of SQL Server production database backups likely containing user accounts, credentials, and business data. Customer data from publicly traded companies — Shufersal (TASE: SAE) retail sales data and ABB (NYSE: ABB) OLAP cube backups. <censored> <censored> |
| Date of Breach | 2026-07-30 |
| Discovery Date | 2026-07-30 |
| Region | NL |
| Target Domain | Pyramid Analytics B.V. |
| Business Sector | Technology |
| Severity | MEDIUM |
Claim by aurora
[analytics] Pyramid Analytics B.V. — a decision-intelligence platform company headquartered in Amsterdam, acquired by ServiceNow (NYSE: NOW) for hundreds of millions of dollars just four months earlier. We obtained the complete source code of the Pyramid Decision Intelligence Platform along with: 10+ copies of the platform source code with full Git history, revealing every feature, algorithm, security module, and AI integration ever built. <censored> <censored> 22 GB of SQL Server production database backups likely containing user accounts, credentials, and business data. Customer data from publicly traded companies — Shufersal (TASE: SAE) retail sales data and ABB (NYSE: ABB) OLAP cube backups. <censored> <censored>
Posted by the aurora threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
Pyramid Analytics B.V.
Leak post (onion / Tor)
http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/pyramid-analytics-bv-5bc96ed0
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.