Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Ernesto Malvestiti S.p.A.

Ernesto Malvestiti S.p.A.

Group Aurora
Discovered 2026-10-26 08:34 UTC
Est. attack date 2026-10-26
Country IT
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM. The exposed material spans the company's entire operations: PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB ×5). GDPR Article 9 special-category data — medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce. 50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more. SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export. ADP payroll SFTP credentials stored in WinSCP.ini — the channel used to transmit employee salary data to the external payroll processor. 614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships. 1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts. 160+ client/supplier contracts with pricing, commercial terms, and executed NDAs. 560+ job candidate CVs with full names, addresses, phone numbers, and career histories.


Leak Screenshot:

Leak Screenshot

Other recent victims