Skip to content
Ransomware News

Ransomware Group aurora Hits: Kochs GmbH

Admin
HookPhish team
Target organization Kochs GmbH Kochs GmbH Manufacturing

Summary

In the latest cybersecurity news, Kochs GmbH — a company operating in the DE — has fallen victim to a ransomware attack conducted by the group aurora. This data breach, discovered on 2026-06-22T09:50:57.145437+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.

Incident Report

Attribute Information
Target Organization Kochs GmbH
Threat Group aurora
Summary [manufacturer] *** — a family-owned German manufacturer of windows, doors, and aluminium façade systems headquartered in Herzogenrath, Nordrhein-Westfalen, with ~240 employees across Germany, the Netherlands, and Hungary.
The exposed material includes:

22 GB of payroll database backups (7 MSSQL .bak files, 2016–2023) — every employee’s salary, bank IBAN, tax class, social insurance number, pension contributions, and wage garnishments.
2.3 GB of DATEV payroll records (through May 2026) — individual named salary documents, garnishment data, company car records for all three entities.
7 Active Directory passwords in plaintext batch scripts — including both Managing Directors, with one MD’s credentials spanning three separate AD domains.
28+ proprietary application source code repositories — WinPro ERP, Apertum CRM, MES integrations, production viewers, time-tracking, and rack-management systems. Each one hardcodes its database credentials.
SSL/TLS private keys for kochs.de (2021–2026) — enabling domain impersonation and man-in-the-middle attacks.
77 VPN pre-shared keys from the LANCOM gateway configuration — the complete remote-access roster since 2018.
Managing Director’s MRI and X-ray scans — brain and spine medical imaging, GDPR Art. 9 special category health data.
16 named employee disciplinary records, 11 driver’s license scans, attorney-client privileged litigation files from two active employment lawsuits.
Complete financial records — 2024 annual accounts, P&L, balance sheets, SFirm banking database, Syska ProFI general ledger, cost accounting through December 2024.

Date of Breach 2026-06-22T00:00:00+00:00
Discovery Date 2026-06-22T09:50:57.145437+00:00
Region DE
Target Domain Kochs GmbH
Business Sector Manufacturing

 

Recommended Security Actions

In response to increasing cyber threats, it’s critical to protect your organization with proactive security measures. HookPhish provides enterprise-grade solutions designed to reduce your risk of future attacks:

Protect your organization before it becomes the next headline. Explore HookPhish.

How HookPhish Helps You Stay Ahead

Don’t wait for a breach to take action — stay informed and take control of your cybersecurity posture today.

You can also check if your organization’s data has been exposed using our free Data Breach Checker.

Disclaimer

HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.

Related articles

Security training designed for people.

See how HookPhish turns phishing simulation, training and threat monitoring into measurable human-risk reduction.

Book a demo Explore solutions