Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reportingAurora claims Chip 1 Exchange, a Germany-based electronics distributor, had about 5.7 GB of Outlook PST email archives taken, spanning years. The group states the stolen data includes HR and recruitment records, payroll data, ITAR registrations and defense customer orders, franchise agreements, and internal documentation and source code. The leak post is published and shows a countdown of 1 day 19 hours 09 minutes 37 seconds; Chip 1 Exchange is named as the victim on the leak page.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Platforms
- NetSuite ERP GoDaddy domain management
What was taken
Chip 1 Exchange — a global independent electronics distributor headquartered in Neu-Isenburg, Germany, with primary US operations in Laguna Hills, California. The dataset spans 13 years (2013-2026) of corporate operations and encompasses: 40+ passport photographs, I-9 forms with SSNs, W-4 tax forms, payroll registers — the complete identity theft toolkit for the entire US, Mexican, and European workforce. A Firefox saved-password vault (53 credentials) with its decryption key — granting immediate access to Wells Fargo corporate banking, NetSuite ERP, GoDaddy domain management, and 15+ supplier portals including Arrow, Farnell, Microchip, and Texas Instruments. Complete 2026 financial intelligence — P&L through July, executive financial health assessment, AR/AP aging, chart of accounts revealing all bank account numbers. 15+ exclusive franchise manufacturer agreements with pricing terms, territory allocations, and per-customer gross profit margins — the core competitive IP of a $100M+ distributor. ITAR registration and defense customer sales orders to Jabil Defense, Curtis-Wright, GEN3 Defense, and Cobham Remec — potential export control violation. 5.7 GB of Outlook PST email archives spanning years of C-suite and employee correspondence.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- Phone
- +1 469 998 2227
- phone
- +1 469 998 2227
- Social
- {"Instagram": "https://www.instagram.com/chip1exchange.official/", "Facebook": "https://www.facebook.com/chip1exchange/", "LinkedIn": "https://www.linkedin.com/company/chip-one-exchange/", "Twitter / X": "https://x.com/chip1exchange", "YouTube": "https://www.youtube.com/channel/UC6NIZYvXOYqAubAuXe9LTZA"}
- Address
- 2202 E. Randol Mill Rd. Arlington, TX 76011, USA
- YouTube
- https://www.youtube.com/channel/UC6NIZYvXOYqAubAuXe9LTZA
- address
- 2202 E. Randol Mill Rd. Arlington, TX 76011, USA
- https://www.facebook.com/chip1exchange/
- https://www.linkedin.com/company/chip-one-exchange/
- https://www.instagram.com/chip1exchange.official/
- X (Twitter)
- https://x.com/chip1exchange/
- Server Link 1
- http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/CHIP1
- Server Link 2
- https://sapurnale.io/data/CHIP1
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.