EDIF S.p.A. in Italy, a wholesale distributor of electrical equipment, plumbing, and lighting systems, was targeted by the aurora ransomware threat actor, resulting in exposed internal data and compromised credentials. The breach includes passwords and transfers for customer systems, certified email and warehouse device information, leaked copies within source code and setup packages, and sensitive customer/employee records such as invoices, tax IDs, addresses, shipment details, and related logs, exposing files tied to Italian operations. #Italy
Incident Details
- Victim: EDIF S.p.A.
- Sector: Manufacturing
- Country: IT
- Actor: aurora
- Source: http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/edif-spa-privateonlyaccess
- Discovered: 2026-09-04T06:53:59.148421+00:00
- Published: 2026-08-27T00:00:00+00:00
Information
- Passwords for company systems, customer file transfers, certified email, and warehouse devices are included, with copies found in source code, setup packages, and old folders.
- Customer and employee information is exposed, including invoices, tax numbers, addresses, phone lists, shipment details, computer-profile artifacts, and CCTV or recorder password reset records.
- The dataset also contains internal software, databases, commercial records, legal and tax folders, and a detailed 2024 financial report.
Disclaimer: This post is based on public claims made by the ransomware group "aurora". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.