Ernesto Malvestiti S.p.A.
bd_f48a2573816d56ed · schema v1 · pii pii-v2
Full breach record for Ernesto Malvestiti S.p.A. →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Aurora on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
[manufacturer] Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM. The exposed material spans the company's entire operations: PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB ×5). GDPR Article 9 special-category data — medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce. 50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more. SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export. ADP payroll SFTP credentials stored in WinSCP.ini — the channel used to transmit employee salary data to the external payroll processor. 614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships. 1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts. 160+ client/supplier contracts with pricing, commercial terms, and executed NDAs. 560+ job candidate CVs with full names, addresses, phone numbers, and career histories.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Oct 26, 2026
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
aurora
According to ransomware.live, Aurora is a ransomware group associated with a multi-purpose Go-based malware distributed by multiple criminal teams from mid-2022, also sold as an infostealer/botnet under the same name on underground forums.