Skip to content
Leak-site post naming Chip 1 Exchange, captured by ThreatCluster

Chip 1 Exchange

aurora

Ransomware leak-site victim intelligence

Data size
1.707 TB
Files
7
Views
35,167
Posted
Sep 2, 2026
Country
Germany
Industry
electronics distribution

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reporting

Aurora claims Chip 1 Exchange, a Germany-based electronics distributor, had about 5.7 GB of Outlook PST email archives taken, spanning years. The group states the stolen data includes HR and recruitment records, payroll data, ITAR registrations and defense customer orders, franchise agreements, and internal documentation and source code. The leak post is published and shows a countdown of 1 day 19 hours 09 minutes 37 seconds; Chip 1 Exchange is named as the victim on the leak page.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
NetSuite ERP GoDaddy domain management

What was taken

Chip 1 Exchange — a global independent electronics distributor headquartered in Neu-Isenburg, Germany, with primary US operations in Laguna Hills, California. The dataset spans 13 years (2013-2026) of corporate operations and encompasses: 40+ passport photographs, I-9 forms with SSNs, W-4 tax forms, payroll registers — the complete identity theft toolkit for the entire US, Mexican, and European workforce. A Firefox saved-password vault (53 credentials) with its decryption key — granting immediate access to Wells Fargo corporate banking, NetSuite ERP, GoDaddy domain management, and 15+ supplier portals including Arrow, Farnell, Microchip, and Texas Instruments. Complete 2026 financial intelligence — P&L through July, executive financial health assessment, AR/AP aging, chart of accounts revealing all bank account numbers. 15+ exclusive franchise manufacturer agreements with pricing terms, territory allocations, and per-customer gross profit margins — the core competitive IP of a $100M+ distributor. ITAR registration and defense customer sales orders to Jabil Defense, Curtis-Wright, GEN3 Defense, and Cobham Remec — potential export control violation. 5.7 GB of Outlook PST email archives spanning years of C-suite and employee correspondence.

Data categories
passport photographsI-9 forms with SSNsW-4 tax formspayroll registersOutlook PST email archivesITAR registration and defense customer sales orders
File types seen
db × 1csv × 1txt × 1docx × 1json × 1xlsx × 2
Sample files (7)
SHA256SUMS.txt
Wires SOP.docx
Chip1 Financials - 2025 Q1 2026.xlsx
PnL 2025-Jul26YTD.xlsx
COA NEW 07.20.26.csv
key3.db
logins.json

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Phone
+1 469 998 2227
phone
+1 469 998 2227
Social
{"Instagram": "https://www.instagram.com/chip1exchange.official/", "Facebook": "https://www.facebook.com/chip1exchange/", "LinkedIn": "https://www.linkedin.com/company/chip-one-exchange/", "Twitter / X": "https://x.com/chip1exchange", "YouTube": "https://www.youtube.com/channel/UC6NIZYvXOYqAubAuXe9LTZA"}
Address
2202 E. Randol Mill Rd. Arlington, TX 76011, USA
YouTube
https://www.youtube.com/channel/UC6NIZYvXOYqAubAuXe9LTZA
address
2202 E. Randol Mill Rd. Arlington, TX 76011, USA
Facebook
https://www.facebook.com/chip1exchange/
LinkedIn
https://www.linkedin.com/company/chip-one-exchange/
Instagram
https://www.instagram.com/chip1exchange.official/
X (Twitter)
https://x.com/chip1exchange/
Server Link 1
http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/CHIP1
Server Link 2
https://sapurnale.io/data/CHIP1

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring the text "Chip 1 EXCHANGE" with a stylized graphic element above it, using green and gray colors.
onion leak page5.5 KB