Aerospace & Advanced Composites GmbH targeted by Aurora ransomware group

• Ransomware group: Aurora
• Country: Germany
• Sector: Manufacturing
• Announcement date: June 22, 2026

Aurora group claims data breach at Aerospace & Advanced Composites GmbH

The Aurora ransomware group has announced a data breach targeting the German manufacturing firm Aerospace & Advanced Composites GmbH. According to the group's announcement on their leak site, they claim to have exfiltrated a significant volume of data, totaling 209 GB, from the organization. This claim was made on June 22, 2026, coinciding with the date the group alleges the attack took place.

Details of the alleged exfiltration

The Aurora group claims to have obtained NAS snapshots that span over 30 years of the company's operational history. This massive collection of data reportedly includes a wide range of information, from research and development files to critical financial statements. By claiming access to decades of snapshots, the threat actor suggests a deep level of access into the organization's historical and current data storage systems.

The leaked material, as claimed by the group, is highly sensitive and covers multiple facets of the company's operations. The specific types of data reported to be involved include:

• R&D and engineering data
• ESA thermal vacuum test archive
• Polymer composite formulations
• Financial statements
• Shareholder agreements
• Employee HR files
• Passport scans
• Social security numbers
• Job applications (CVs)
• IT credentials
• Bitlocker recovery keys

The breadth of this data, ranging from technical engineering archives to highly personal employee information, highlights the potential impact of such an incident.

Potential risks and industry implications

The nature of the data claimed to be stolen poses significant risks to the organization. The inclusion of R&D files and proprietary engineering data, such as polymer composite formulations and ESA thermal vacuum test archives, could represent a direct threat to the company's competitive advantage. Furthermore, the presence of Non-Disclosure Agreements (NDAs) with partners suggests that the breach could impact the company's professional relationships and supply chain security.

Beyond intellectual property, the leakage of personal information—including passport scans, social security numbers, and HR files—could lead to serious legal consequences under the General Data Protection Regulation (GDPR). Such data is highly valuable to cybercriminals for identity theft and the execution of targeted phishing attacks against both employees and the company itself.

If the claims made by the Aurora group are accurate, the organization may face the complexities of double extortion. This is a common tactic in modern ransomware attacks where threat actors not only encrypt systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. For organizations in the manufacturing and aerospace sectors, such incidents can result in complex challenges regarding supply chain integrity and the protection of sensitive partner information.

To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing strict access controls, maintaining regular and secure backups, and employing multi-factor authentication to protect IT credentials. Monitoring for unauthorized data exfiltration and ensuring compliance with data protection regulations are also critical components of a modern cybersecurity posture. In the event of a breach, organizations must often navigate complex legal requirements regarding the notification of affected individuals and regulatory bodies.