Aerospace & Advanced Composites GmbH Listed by aurora Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Aerospace & Advanced Composites GmbH was listed by the aurora ransomware group on June 22, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may be affected; anyone connected to the organisation should verify whether their data was involved and take protective steps.
On 22 June 2026 the ransomware group aurora listed Aerospace & Advanced Composites GmbH on its data-leak site. The listing states that internal files were taken from the Austrian company during a ransomware operation. No figure for the number of individuals affected has been published, and the company has not issued a public statement confirming or denying the claims.
The incident forms part of a wider pattern in which ransomware groups target organisations holding specialised technical and research data. Such listings are used to pressure victims into paying for the non-release or non-sale of the material.
What happened
The only public record of the incident is the entry placed by aurora on its leak site on 22 June 2026. The entry asserts that two complete NAS snapshots were obtained. No independent confirmation of the data acquisition, the encryption of systems, or any ransom demand has been made available. The number of people whose information may be involved remains unknown.
Who is aurora?
Aurora is a ransomware group that maintains a public leak site where it lists organisations from which it claims to have stolen data. The group follows the common practice of combining encryption of victim systems with the threat of publishing or selling exfiltrated files. Its listings are presented by the group itself and are not verified by third parties unless additional evidence emerges.
Who is Aerospace & Advanced Composites GmbH?
Aerospace & Advanced Composites GmbH is an Austrian research and development company based in Wiener Neustadt. It works on space-materials projects and maintains documented connections to the European Space Agency. Organisations of this type routinely hold technical test records, formulation data, engineering documentation and administrative records spanning many years of operation.
What data was at risk
The aurora listing describes two snapshots: one dated 31 December 2022 containing 123 GB of Testhouse, R&D and engineering material, including an ESA thermal-vacuum test archive, polymer-composites formulations and 22 Outlook PST files; the second dated 14 January 2025 containing 86 GB of administrative material, including a managing-director workstation backup and 15 years of financial statements. The precise contents and any additional files remain unconfirmed beyond the group’s description.
Why it matters
Technical and financial records held by research organisations can contain proprietary methods, test results and personal identifiers. If the material described in the listing is authentic, affected individuals may face risks of identity misuse or targeted fraud, while the organisation may encounter competitive or regulatory consequences from the exposure of long-term project data.
What to do if you're exposed
Individuals who believe their information may be involved should begin with basic protective steps.
- Review recent account activity for any unauthorised access.
- Change passwords for email and any linked services, using unique values for each.
- Enable multi-factor authentication wherever available.
- Monitor bank and credit statements for unexpected transactions.
- Run a free exposure scan of their email address against known breach data sets to check for further appearances.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Kochs GmbH Listed by aurora Ransomware GroupSumitomo Electric Bordnetze Listed by aurora Ransomware GroupGILDE Handwerk Macrander GmbH & Co. KG Listed by aurora Ransomware GroupEvosys Laser GmbH Listed by aurora Ransomware GroupLatest breaches
Publicly posted by aurora — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.