Corporación Primax S.A. targeted in alleged data leak by aurora

• Ransomware group: aurora
• Country: Peru
• Sector: Retail & E-Commerce
• Announcement date: June 23, 2026

Aurora group claims data breach at Corporación Primax S.A.

The threat actor known as aurora has claimed to have leaked a wide range of sensitive information allegedly belonging to Corporación Primax S.A.. According to an announcement made on the group's leak site on June 23, 2026, the attackers claim to have successfully accessed and exfiltrated various types of data, including financial, operational, and personal records. This development suggests a targeted operation aimed at compromising the integrity of the organization's data assets.

The incident was reported on June 23, 2026, the same day the group claims the attack occurred. While the group has listed the organization on its leak site, information regarding this specific threat actor remains limited. The group appears to be utilizing a leak site to publicize the breach, a common tactic in modern cyber extortion campaigns.

Details of the alleged data theft

The aurora group claims to have accessed a diverse array of sensitive information. The scope of the alleged theft is significant, covering various layers of the organization's digital environment. The threat actor claims to have obtained access to data ranging from high-level financial reports to granular employee identity information and technical network configurations. This variety of data suggests a deep level of access within the target's systems.

The specific types of data allegedly involved in this breach include:

• Financial reports
• Employee identity data
• Bank account details
• Salary data
• System credentials
• OT network maps
• POS transaction data
• Legal documentation

The group claims that the identity data stolen belongs to between 15,000 and 60,000 individuals, specifically mentioning details such as DNI, bank accounts, and salary information. Furthermore, the group claims to have exfiltrated 54 GB of POS transaction data, alongside operational technology (OT) network maps and various system credentials. No information was provided regarding the total size of the data or the specific ransom demand.

About Corporación Primax S.A.

Corporación Primax S.A. is a major fuel distribution company based in Peru. The organization maintains an extensive operational footprint, providing fuel supply and retail services across several countries, including Peru, Ecuador, Colombia, and Uruguay. Through its vast network of stations, the company serves as a critical provider of energy and retail services within the region.

Risk assessment and industry implications

The nature of the data allegedly leaked by aurora poses a high risk of identity theft and fraud for both the employees and the customers of Corporación Primax S.A. The exposure of sensitive personal information, such as bank accounts and identity numbers, provides malicious actors with the necessary tools to conduct financial crimes. Additionally, the exposure of system credentials and operational technology (OT) network maps presents a severe security risk, as it could facilitate secondary attacks against the organization's critical infrastructure.

This incident highlights the growing trend of double extortion, a tactic where ransomware groups not only encrypt an organization's data but also threaten to leak it publicly to exert maximum pressure. By leaking data, attackers aim to damage an organization's commercial reputation and disrupt its operational continuity. Such tactics are designed to force a ransom payment by leveraging the threat of public exposure and regulatory consequences. In this case, the organization may face legal sanctions under the data protection regulations of Peru and the other countries where it operates.

For organizations in the retail and fuel distribution sectors, such incidents underscore the importance of robust defensive measures. Protecting critical infrastructure and sensitive customer data requires comprehensive security strategies, including strict access controls, network segmentation to protect OT environments, and continuous monitoring of systems. Organizations must also prepare for the legal and reputational fallout that follows a data breach by maintaining strong incident response plans and ensuring compliance with regional data protection laws.