Aur0ra

Active
39 victims named on the leak site
11 in the last 30 days
39 in the last 12 months
Apr 2026 first victim we recorded
Sep 8, 2026 most recent victim posted
2 leak sites tracked

Data as of September 15, 2026.

Credential exposure before the attack

20.5% of Aur0ra victims whose domain we can identify (8 of 39) had employee credentials leak in the 12 months before Aur0ra named them as a victim.

We don't know whether any of these credentials were how Aur0ra gained initial access.

What industries Aur0ra targets

Sector identified for 32 of 39 victims.

Manufacturing12
Logistics5
Healthcare4
Real Estate2
Legal2
Construction2
Hospitality1
Agriculture1

Where the victims are located

Country identified for 37 of 39 victims.

United States15
Germany8
Canada3
Australia2
Austria2
Netherlands2
France1
United Kingdom1

Most recent Aur0ra victims

VictimSectorCountryPosted
Benshaw benshaw.comManufacturingUnited StatesSep 8, 2026
Jinny Beauty Supply jinny.comNot identifiedNot identifiedSep 8, 2026
Gruppo Edif gruppoedif.itNot identifiedItalySep 7, 2026
Metrea metrea.aeroGovernmentUnited StatesSep 7, 2026
Chip 1 Exchange chip1.comNot identifiedGermanySep 3, 2026
Ishbia & Gagleard iglawfirm.comLegalUnited StatesSep 1, 2026
SCA Logistik & Fulfillment sca-muc.deLogisticsGermanyAug 28, 2026
ShipERP shiperp.comLogisticsUnited StatesAug 27, 2026
4 Coils Tech 4coilstech.euManufacturingCzech RepublicAug 19, 2026
Natco Home natcohome.comManufacturingUnited StatesAug 19, 2026
PGMM pgmm.comReal EstateGermanyAug 19, 2026
Freywille freywille.comManufacturingAustriaAug 12, 2026
GILDE Handwerk Macrander gildehandwerk.comNot identifiedGermanyAug 5, 2026
US Installation Group us-installations.comNot identifiedUnited StatesAug 5, 2026
Van Eijck eijck.comLogisticsNetherlandsJul 31, 2026
Evosys Laser evosys-laser.comManufacturingGermanyJul 31, 2026
Pyramid Analytics pyramidanalytics.comTechnologyUnited StatesJul 31, 2026
Bretford Manufacturing bretford.comHealthcareUnited StatesJul 30, 2026
Primed Halberstadt Medizintechnik primed-halberstadt.deHealthcareGermanyJul 1, 2026
Primax primax.comManufacturingTaiwanJun 24, 2026

Showing the 20 most recent of 39. Browse recent data breaches for more.

Aur0ra leak sites

Addresses we've seen Aur0ra publish victims from. Any .onion address needs the Tor Browser.

  • u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion
  • pavregldzg2ypbd3gxbil2suxfok7ykmcknwhkli24anpks6lndymyyd.onion

Aur0ra questions

Is Aur0ra still active?

Yes. Aur0ra posted its most recent victim on September 8, 2026. That's 11 victims in the last 30 days.

How many victims has Aur0ra claimed?

Aur0ra has named 39 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did Aur0ra first appear?

The first victim we recorded for Aur0ra was posted on April 30, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Aur0ra target?

Manufacturing accounts for the most victims we can classify, with 12. Logistics follows at 5. We could identify a sector for 32 of 39 victims, so treat this as the shape of the targeting rather than a full census.

Has Aur0ra already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.