Kochs GmbH targeted by Aurora ransomware group

• Ransomware group: Aurora
• Country: Germany
• Sector: Manufacturing
• Announcement date: June 22, 2026

Aurora group claims data breach at Kochs GmbH

The Aurora ransomware group has announced a significant data breach involving the German manufacturing firm Kochs GmbH. According to a notice published on the group's leak site on June 22, 2026, the threat actors claim to have compromised and leaked extensive datasets belonging to the organization. This announcement follows the group's claim of conducting the attack on the same day the notice was posted.

The group's claims suggest a highly invasive breach that targets various layers of the company's digital infrastructure. The announcement lists a wide variety of critical materials, indicating that the attackers may have gained access to both administrative and operational data. The materials identified in the group's claim include sensitive financial records, detailed employee information, and high-level executive credentials.

The scope of the alleged data leak

The content allegedly stolen and released by the Aurora group is diverse, covering financial, technical, and highly personal information. The group claims to have obtained backups of payroll databases and specific DATEV payroll records, which are highly sensitive for any organization's human resources and accounting departments. Furthermore, the breach reportedly includes technical assets that could jeopardize the company's network security, such as Active Directory passwords, SSL/TLS private keys, and VPN pre-shared keys.

In addition to technical and financial data, the group claims to have accessed highly sensitive personal information. This includes disciplinary records, scans of driver's licenses, and even medical imaging scans, specifically MRI and X-ray files belonging to a director. The list of allegedly compromised data includes:

• Payroll database backups
• Payroll records
• Active Directory passwords
• Application source code
• SSL/TLS private keys
• VPN pre-shared keys
• Medical imaging scans
• Disciplinary records
• Driver's license scans
• Financial records

About Kochs GmbH

Kochs GmbH is a family-owned German manufacturer. The company specializes in the production of windows, doors, and aluminium façade systems. Operating across Germany, the Netherlands, and Hungary, the organization maintains a workforce of approximately 240 employees.

Potential impact and industry implications

The claimed leak poses significant risks to the operational processes and overall data security of Kochs GmbH. The exposure of sensitive health data and executive credentials is particularly concerning, as such information may fall under high-risk data breach categories under the General Data Protection Regulation (GDPR) in the European Union. The disclosure of such sensitive information often triggers complex regulatory compliance processes and potential legal scrutiny.

From a technical standpoint, the leakage of proprietary application source code and SSL keys could potentially facilitate secondary attacks or identity theft attempts against the organization. Furthermore, the availability of financial and personnel data increases the risk of targeted phishing campaigns or double extortion tactics. In double extortion, ransomware groups not only encrypt data but also threaten to leak it to pressure the victim into paying the ransom.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits. Protecting sensitive intellectual property, such as source code, and ensuring the encryption of highly personal data like medical or identity documents are critical components of a modern defense-in-depth strategy to mitigate the impact of such breaches.