1. Executive summary
The aurora ransomware group listed ARX Group SA, a Swiss engineering consultancy with more than 25 offices in 17 countries, on its leak site on 2026-10-23, claiming to hold 9,510 project fee structures, 8 GB of Ceneri Base Tunnel as-built documentation and 881,205 employee time entries. The listing is a claim by the operator; no source confirms the intrusion vector, the encryption event, or whether the data has been published in full. No CVE is associated with this item and no CISA KEV exploitation state applies. The exposure is commercial and contractual rather than code-execution: billing-rate intelligence and national-infrastructure engineering records belonging to a supplier that EMEA banks and infrastructure financiers may hold under contract. Adverse Trace assesses the attribution to "aurora" as unconfirmed; the group has no MITRE ATT&CK profile and the only source is the leak-site index.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | A named engineering supplier holding project fee structures and infrastructure records is the breached party; clients must know whether that supplier is in their ICT third-party register and what data it held on them. | Confirm whether ARX Group SA is a registered ICT third-party provider and whether the leaked billing or project data includes your engagements. |
| DORA Art. 29 | The leaked material is pricing and project intelligence for a supplier with federal infrastructure contracts; concentration and substitutability of that supplier now need assessment. | Reassess concentration risk where ARX Group SA is a non-substitutable supplier for engineering or billing services. |
| NIS2 Art. 21(2)(d) | The breach is at a supplier in the client's supply chain, and the leaked records include national critical-infrastructure documentation. | Review supply chain security measures covering this supplier relationship and any downstream dependency on the leaked records. |
3. Technical analysis & attack chain
No confirmed attack chain is available. The only source is the ransomware.live leak-site index, which records the operator's claim and the categories of data it says it holds. It does not describe initial access, the exploited component, the malware, persistence, command-and-control, lateral movement, or the exfiltration method. Any step-by-step chain would be fabrication.
What the listing states, as the operator's claim:
- aurora listed ARX Group SA on its leak site on 2026-10-23.
- The claimed material includes 9,510 project fee structures with internal and external billing rates for every engineer.
- The claimed material includes 8 GB of Ceneri Base Tunnel documentation described as as-built engineering records.
- The claimed material includes 881,205 time entries with task descriptions and project assignments.
The source describes ARX Group SA as an engineering consultancy with 25+ offices in 17+ countries and contracts including the Ceneri Base Tunnel and USTRA/SBB federal infrastructure work. The listing does not state whether data was encrypted, whether a ransom was demanded, whether negotiation occurred, or whether any data has been published beyond the leak-site post.
Confidence caveat: every fact above is single-sourced to the ransomware.live index and is the operator's own claim. The volume figures (9,510 fee structures, 881,205 time entries, 8 GB) are unverified. Treat the attribution to "aurora" as unconfirmed: the group has no MITRE ATT&CK profile, and no independent reporting corroborates the intrusion. Verify before acting on the data categories as fact.
4. Mitigation & containment
P1 within 24h
- Determine whether ARX Group SA appears in your ICT third-party register and whether any current or recent engagement data (billing rates, project assignments, time entries) could be in the claimed 9,510 fee structures or 881,205 time entries. This is a supplier-data question, not a network one.
- If you hold ARX Group SA engineering records or as-built documentation derived from the Ceneri Base Tunnel or other federal infrastructure work, classify those records and restrict access pending confirmation of what leaked.
- Ask ARX Group SA directly, in writing, for the scope of the incident: which systems, which data categories, whether encryption occurred, and whether notification obligations have been triggered.
P2 within 72h
- Review contracts with ARX Group SA against DORA Art. 30 key contractual provisions, specifically breach-notification timelines and data-return or data-destruction clauses covering the leaked categories.
- Where leaked billing rates could expose your own negotiated pricing to competitors, brief procurement and commercial teams so they are not surprised by market intelligence derived from the leak.
P3 within 7 days
- Update the concentration-risk assessment for this supplier under DORA Art. 29 if ARX Group SA is non-substitutable for engineering or billing services.
- Monitor the leak site for publication of the claimed data and reassess exposure if the operator releases it.
No vendor fix, patch, version pin or configuration change applies: this is a third-party data-exposure event, not a vulnerability in a product you run.
5. Indicators of compromise
No indicators of compromise available in the source material. The source provides no hashes, domains, IP addresses, file paths, registry keys or command lines. The only atomic reference is the leak-site listing URL, which is a public index page, not a malicious artefact, and is cited in §7 rather than reproduced here.
6. Detection
Insufficient indicators to author detection rules. The source contains no malware strings, command-line flags, file names, registry keys, ransom-note text or network indicators from which a YARA or Sigma rule could be built. A rule keyed on the group name or victim name would detect reporting about the event, not the threat.
7. Sources
- ransomware.live, "Victim: ARX Group SA – aurora", https://www.ransomware.live/id/QVJYIEdyb3VwIFNBQGF1cm9yYQ==, published 2026-10-23.
8. Adverse Trace position
Adverse Trace assesses this as a third-party data-exposure event with commercial and contractual impact, not a technical compromise of client infrastructure. No CVE is associated, no CISA KEV exploitation state applies, and the attribution to "aurora" is unconfirmed: the group has no MITRE ATT&CK profile and the claim rests on a single leak-site source. The material that matters to EMEA financial services clients is the billing-rate intelligence and the infrastructure documentation, both of which sit in supplier relationships rather than in client systems. We will monitor the leak site for publication of the claimed data, and we will update this advisory if ARX Group SA or an independent source confirms the intrusion scope, the data categories, or the actor behind it. Clients should confirm their supplier exposure to ARX Group SA before treating the claimed data volumes as fact.
Published via PulseTrace — Adverse Trace threat intelligence.