Laboratorios Roemmers SAICF
bd_52348f4bae388294 · schema v1 · pii pii-v2
Full breach record for Laboratorios Roemmers SAICF →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Aurora on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue, with €1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) — Argentina's equivalent of a Social Security Number — combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records — employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms — individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers. <redacted> 82 GB of drug formulations — the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain. 14 GB of internal drug pricing strategy and competitive intelligence
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Oct 1, 2026
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
aurora
According to ransomware.live, Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.