Aur0ra
Data as of August 16, 2026.
Credential exposure before the attack
25% of Aur0ra victims whose domain we can identify (7 of 28) had employee credentials leak in the 12 months before Aur0ra named them as a victim.
We don't know whether any of these credentials were how Aur0ra gained initial access.
What industries Aur0ra targets
Sector identified for 24 of 28 victims.
| Manufacturing | 9 | |
| Healthcare | 4 | |
| Logistics | 3 | |
| Construction | 2 | |
| Real Estate | 1 | |
| Hospitality | 1 | |
| Legal | 1 | |
| Agriculture | 1 |
Where the victims are located
Country identified for 27 of 28 victims.
| United States | 10 | |
| Germany | 5 | |
| Canada | 3 | |
| Australia | 2 | |
| Austria | 2 | |
| Netherlands | 2 | |
| France | 1 | |
| United Kingdom | 1 |
Most recent Aur0ra victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Freywille freywille.com | Manufacturing | Austria | Aug 12, 2026 |
| GILDE Handwerk Macrander gildehandwerk.com | Not identified | Germany | Aug 5, 2026 |
| US Installation Group us-installations.com | Not identified | United States | Aug 5, 2026 |
| Van Eijck eijck.com | Logistics | Netherlands | Jul 31, 2026 |
| Evosys Laser evosys-laser.com | Manufacturing | Germany | Jul 31, 2026 |
| Pyramid Analytics pyramidanalytics.com | Technology | United States | Jul 31, 2026 |
| Bretford Manufacturing bretford.com | Healthcare | United States | Jul 30, 2026 |
| Primed Halberstadt Medizintechnik primed-halberstadt.de | Healthcare | Germany | Jul 1, 2026 |
| Primax primax.com | Manufacturing | Taiwan | Jun 24, 2026 |
| Aerospace & Advanced Composites aac-research.at | Not identified | Austria | Jun 23, 2026 |
| DUAL Group dualinsurance.com | Financial Services | United Kingdom | Jun 23, 2026 |
| KOCHS kochs.de | Manufacturing | Germany | Jun 23, 2026 |
| NTP ntp.nl | Construction | Netherlands | Jun 23, 2026 |
| ALS Global alsglobal.com | Not identified | Australia | Jun 22, 2026 |
| Hagerman & Company hagerman.com | Healthcare | United States | Jun 22, 2026 |
| Allan Brothers Fruit allanbrosfruit.com | Agriculture | United States | Jun 17, 2026 |
| Diamond Truck Centres dit.ca | Logistics | Canada | Jun 17, 2026 |
| Sumitomo Electric Bordnetze sebn.com | Manufacturing | Germany | Jun 17, 2026 |
| Avanti Windows & Doors avantiwindow.com | Construction | Canada | May 13, 2026 |
| NorthWest Handling Systems nwhs.com | Manufacturing | United States | May 13, 2026 |
Showing the 20 most recent of 28. Browse recent data breaches for more.
Aur0ra leak site
The address we've seen Aur0ra publish victims from. Any .onion address needs the Tor Browser.
u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion
Aur0ra questions
Is Aur0ra still active?
Yes. Aur0ra posted its most recent victim on August 12, 2026. That's 7 victims in the last 30 days.
How many victims has Aur0ra claimed?
Aur0ra has named 28 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Aur0ra first appear?
The first victim we recorded for Aur0ra was posted on April 30, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Aur0ra target?
Manufacturing accounts for the most victims we can classify, with 9. Healthcare follows at 4. We could identify a sector for 24 of 28 victims, so treat this as the shape of the targeting rather than a full census.
Has Aur0ra already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.