Kochs GmbH Listed by aurora Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Kochs GmbH was listed by the aurora ransomware group on June 22, 2026, with internal files reported as exfiltrated. Anyone connected to the company should check for notifications and review their accounts for unusual activity.
Employees of a German manufacturer may face long-term financial and privacy risks after a ransomware group listed the company and described internal payroll files it says were taken. The number of people affected remains unknown, and the organisation has not confirmed the details of any incident.
What happened
On 22 June 2026 the ransomware group aurora listed Kochs GmbH on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. No confirmed count of affected individuals has been published, and the organisation has not released an official statement on the matter.
Who is aurora?
Aurora is a ransomware operation that has been publicly tracked for several years. Groups of this type typically gain access through phishing, remote-desktop vulnerabilities or stolen credentials, deploy encryption on target systems, and then threaten to publish stolen data if a ransom is not paid. The listing of Kochs GmbH constitutes the group’s claim of responsibility; independent confirmation of the data’s authenticity or the circumstances of its acquisition has not been made public.
Who is Kochs GmbH?
Kochs GmbH is a family-owned German manufacturer of windows, doors and aluminium façade systems, headquartered in Herzogenrath, Nordrhein-Westfalen. It employs roughly 240 people across sites in Germany, the Netherlands and Hungary. Companies of this size routinely process detailed employment records, including salary, tax and social-insurance information, for their workforce and sometimes for staff at related legal entities.
What data was at risk
The listing describes 22 GB of payroll database backups covering 2016–2023 and 2.3 GB of DATEV payroll records through May 2026. These files are said to contain salary figures, bank IBANs, tax classes, social-insurance numbers, pension contributions, wage-garnishment data and company-car records for the three entities. The exact scope of any confirmed exposure has not been verified by the company or by independent investigators.
What's at stake
Payroll data can be used for identity theft, targeted fraud or financial monitoring of individuals. In Germany, social-insurance numbers and tax details are particularly sensitive because they are tied to state benefits and tax filings. For the organisation, the incident may trigger regulatory scrutiny under data-protection law and could affect relations with employees and business partners.
Were you affected?
Individuals who worked at Kochs GmbH or its related entities between 2016 and May 2026 should monitor their bank accounts and tax records for unusual activity. Practical first steps include:
- Contacting the company’s data-protection officer for any official notification.
- Requesting a free copy of personal data held by the employer under GDPR.
- Placing fraud alerts with banks and credit agencies if salary or IBAN details appear to have been exposed.
- Running a free exposure scan of their email address against known breach datasets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Aerospace & Advanced Composites GmbH Listed by aurora Ransomware GroupSumitomo Electric Bordnetze Listed by aurora Ransomware GroupGILDE Handwerk Macrander GmbH & Co. KG Listed by aurora Ransomware GroupEvosys Laser GmbH Listed by aurora Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Kochs GmbH Listed by aurora Ransomware Group →
Publicly posted by aurora — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.