> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Aurora ransomware group leaks EWM Group customer and employee data
- URL: https://f4n6.co.uk/security-feed/aurora-ransomware-group-leaks-ewm-group-customer-and-employee-data/
- Published: 2026-10-28T21:23:32.000Z
- Updated: 2026-10-28T21:23:32.000Z
- Author: Jeff Davies
- Tags: #security-feed, aurora

## 1\. Executive summary

The aurora ransomware group listed EWM Group, the parent of UK value fashion chains Bonmarché, Edinburgh Woollen Mill and Peacocks, on its leak site on 2026-10-28, claiming to hold 503,878 loyalty programme member records, roughly 21,000 employee records, 100+ GB of Outlook PST archives, 313+ SQL Server database backups across 122 databases, and 83 GB of e-commerce transaction data. The data described is identity, financial and health-adjacent personal data on UK residents, including National Insurance numbers, bank account and sort code details, and accident reports with injury details. No CVE, CVSS score, EPSS estimate or CISA KEV entry is associated with this item, and the actor has no MITRE ATT&CK profile, so the attribution to "aurora" is unconfirmed and rests on the leak-site listing alone. For EMEA financial services the direct exposure is second-order: customers and staff whose bank details, NI numbers and transaction histories are in the dump are the same population banks onboard, and the credential and identity material is usable for account takeover and authorised push payment fraud against institutions that have no relationship with EWM Group.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                                 | Practical impact                                                                                                                                                                                                                                            |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles | The leaked estate includes 313+ SQL Server database backups and 100+ GB of staff email archives, the kind of data a retailer's outsourced IT, backup or payroll providers hold. | Firms that use the same backup, payroll (the WAGESTRANSFER database is named) or managed-service providers as EWM Group should confirm which of their own third parties appear in the dump and whether contractual data-handling terms cover this exposure. |
| NIS2 Art. 21(2)(d): supply chain security measures     | Employee bank sort code and account number data held in a third-party wage-access product (WAGESTRANSFER) is in the leak.                                                       | Entities in scope should assess wage-access and payroll providers in their own supply chain for the same concentration of bank detail, and record the assessment.                                                                                           |

No DORA or NIS2 article is engaged by the mere fact of a third-party breach. The two rows above turn on the specific third-party data categories named in the listing.

## 3\. Technical analysis & attack chain

The source is a leak-site listing. It states what aurora claims to hold and gives no initial access vector, no exploited component, no malware family, no command-and-control detail and no timeline of intrusion. The following is the confirmed sequence as far as the listing supports it, and no further.

1. aurora listed EWM Group on its leak site on 2026-10-28 at 13:00 UTC, naming the victim, the country (GB) and the three retail brands.
2. The listing asserts exfiltration of the data sets below. The claim is unverified: no sample, no independent confirmation and no EWM Group statement are in the source.

The claimed data sets, with the fields the listing names:

- 503,878 loyalty programme member records: full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000 to 2026.
- Approximately 21,000 employee records: salary, National Insurance number (stated as held via P11D), bank sort code and account number (stated as held in the WAGESTRANSFER database), home address, emergency contacts, maternity and paternity data, sickness absence, and accident reports with injury details.
- 100+ GB of Outlook PST email archives: complete email histories for named staff members spanning years.
- 313+ SQL Server database backups across 122 unique databases.
- 83 GB of e-commerce transaction data: online orders from January 2021 to August 2026.

The technical significance for a defender is the shape of the estate rather than any exploit. Full SQL Server backups across 122 databases and multi-year PST archives indicate access to backup storage and mail infrastructure, not a single application database. The listing does not say how that access was obtained, whether backups were encrypted or only copied, or whether any ransom demand or deadline was set. The source does not state that systems were encrypted; it describes data theft and publication only, so this should be treated as a data-leak and extortion claim, not a confirmed ransomware encryption event.

Attribution caveat: the actor name "aurora" appears only in the leak-site listing. There is no MITRE ATT&CK profile for this actor and no corroborating vendor report in the source material. The attribution is unconfirmed and single-sourced; do not map it to a known intrusion set on the strength of the name.

## 4\. Mitigation & containment

The item concerns a third party's breach, so most actions are supplier and fraud-control measures rather than containment on the client's own estate.

P1 within 24h

- Search your customer base for matches against the EWM Group loyalty population (Bonmarché, Edinburgh Woollen Mill, Peacocks cardholders) and flag matched accounts for step-up authentication and transaction monitoring, prioritising accounts where the loyalty record's address, date of birth and phone match the bank's KYC record.
- Brief the fraud team on the specific data in circulation: full name, address, date of birth, phone, email, loyalty card number and 2000 to 2026 transaction history are enough to pass knowledge-based verification and to craft convincing impersonation. Suspend knowledge-based authentication challenges for any customer matched to the dump.
- If your firm uses WAGESTRANSFER or the same payroll provider named in the listing, ask the provider in writing whether EWM Group data sat in shared infrastructure and whether your data was segregated.

P2 within 72h

- Add the leaked employee data categories to insider and mule-account detection: National Insurance number, salary and bank sort code/account number combinations from the EWM Group staff set can seed fraudulent account openings and benefit or loan applications. Screen new account applications against the affected postcodes and employer name.
- Review third-party contracts with backup, email-archiving and payroll providers against DORA Art. 28 and, where in NIS2 scope, Art. 21(2)(d): confirm data segregation, breach notification timelines and the right to audit. Record the outcome.
- Where your own staff are former EWM Group employees, check whether their payroll bank details were held in the WAGESTRANSFER database and advise them to watch for mandate-change fraud.

P3 within 7 days

- Run a retrospective fraud review over the period since the data is claimed to have been taken, looking for authorised push payment patterns consistent with a large identity and bank-detail corpus: new payee additions shortly after a contact-detail change, and invoice or payroll diversion.
- Confirm your own backup and PST retention does not concentrate 100+ GB of mail and full database backups in a single reachable location; the EWM Group listing shows what a single compromise of that storage yields.

No vendor fix or patch applies: no CVE is associated with this item.

## 5\. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IP addresses, file paths) are present in the source material. The source is a leak-site listing with no technical artefacts.

Behavioural indicators, from the data categories the listing describes:

| Behaviour                                                             | Where to observe                                    | Confidence                                                              |
| --------------------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------- |
| Bulk access to full SQL Server database backups across many databases | Backup storage and database backup job logs         | Low; inferred from the claimed 313+ backups, not from observed activity |
| Mass export of Outlook PST mail archives for named staff              | Exchange/mail server export logs, eDiscovery audit  | Low; inferred from the claimed 100+ GB of PST files                     |
| Extraction of payroll bank details from a WAGESTRANSFER database      | Payroll system access logs                          | Low; single-sourced to the listing                                      |
| Bulk read of loyalty and e-commerce transaction tables                | Database query audit logs, e-commerce platform logs | Low; inferred from the claimed record counts                            |

These behaviours are single-sourced to the leak-site listing and are not confirmed by any independent report. Verify before building detection around them.

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no file hashes, command-line strings, mutex names, registry keys, ransom-note text or network artefacts to build a YARA or Sigma rule from. The data categories in §5 are inferences from a claim, not artefacts of the threat, and would not support a reliable rule.

## 7\. Sources

- ransomware.live, "Ransomware: aurora named EWM Group (GB)", https://www.ransomware.live/id/RVdNIEdyb3VwQGF1cm9yYQ==, published 2026-10-28.

## 8\. Adverse Trace position

Adverse Trace assesses this as a data-leak and extortion claim by an actor with no MITRE ATT&CK profile and no corroborating reporting, so the attribution to "aurora" is unconfirmed and the data sets are unverified; no CVE, CVSS score, EPSS estimate or CISA KEV entry applies. The client impact for EMEA financial services is indirect but concrete: a large corpus of UK identity, bank-detail and transaction data that feeds account takeover and authorised push payment fraud against institutions with no relationship to EWM Group. We will monitor for independent confirmation of the leak, for any sample or data-set validation, and for the appearance of the EWM Group data in criminal marketplaces, and we will update this advisory if a corroborating source or a confirmed intrusion vector emerges. Clients should treat the fraud-control actions in §4 P1 as the priority and record their third-party assessment under DORA Art. 28 where the named payroll and backup providers are shared.

---

[Read the original source →](https://www.ransomware.live/id/RVdNIEdyb3VwQGF1cm9yYQ==?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*