Ransomware group aurora hits Rechtsanwaltskanzlei Dr. Bien
Rechtsanwaltskanzlei Dr. Bien — a professional services target operating in DE has been listed by the aurora ransomware group on 2026-10-12. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Rechtsanwaltskanzlei Dr. Bien |
|---|---|
| Threat Group | aurora |
| Summary | [law] Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen. The exposed material includes: 2,387 WinSolvenz case databases — each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details. 492+ forced administration (Zwangsverwaltung) case files — property addresses, tenant data, rent records, utility accounts, insurance details, court-directed property management reports. <redacted> 80 GB MailStore email archive — the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures. 1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court. 35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements. DATEV tax/accounting archives — 33 directories of income tax backups, insolvency accounting, third-party mandates. |
| Date of Breach | 2026-10-12 |
| Discovery Date | 2026-10-12 |
| Region | DE |
| Target Domain | Rechtsanwaltskanzlei Dr. Bien |
| Business Sector | Professional Services |
| Severity | MEDIUM |
Claim by aurora
[law] Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen. The exposed material includes: 2,387 WinSolvenz case databases — each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details. 492+ forced administration (Zwangsverwaltung) case files — property addresses, tenant data, rent records, utility accounts, insurance details, court-directed property management reports. <redacted> 80 GB MailStore email archive — the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures. 1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court. 35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements. DATEV tax/accounting archives — 33 directories of income tax backups, insolvency accounting, third-party mandates.
Posted by the aurora threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
Rechtsanwaltskanzlei Dr. Bien
Leak post (onion / Tor)
http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/rechtsanwaltskanzlei-dr-bien-88f4b584
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.