Skip to content
Leak-site post naming EDIF S.p.A., captured by ThreatCluster

EDIF S.p.A.

aurora

Ransomware leak-site victim intelligence · EN

Data size
1.707 TB
Files
4
Views
39,359
Posted
Sep 4, 2026
Country
Italy
Industry
wholesale distribution

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

Aurora states they have taken data from EDIF S.p.A., an Italian wholesale distributor of electrical equipment, plumbing and lighting systems. They claim the data includes customer and employee information, invoices, tax numbers, addresses, phone lists, shipment details, internal software and databases, commercial records, legal/tax folders, and a detailed 2024 financial report. The leak page is listed by the group, which claims 4 files were taken.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
https://www.gruppoedif.it/

What was taken

EDIF S.p.A. is an Italian wholesale distributor of electrical equipment, plumbing, and lighting systems. The exposed files include passwords for company systems, customer file transfers, certified email and warehouse devices. Copies appear in source code, setup packages and old folders. Customer and employee information is also exposed: invoices, tax numbers, addresses, phone lists, shipment details, computer-profile artifacts and records about CCTV or recorder password resets. The dataset contains internal software, databases, commercial records, legal/tax folders and a detailed 2024 financial report.

Data categories
customer informationemployee informationinvoicestax numbersaddressesphone listsshipment detailscomputer-profile artifactsrecords about CCTV or recorder password resetsinternal softwaredatabasescommercial recordslegal/tax foldersdetailed 2024 financial report
Leak site tags
wholesale
File types seen
ini × 3config × 1
Sample files (4)
ddt-Cliente_651355_Facile_Ristrutturare.ini
Cliente_651355.ini
conferme-Cliente_651355_Facile_Ristrutturare.ini
App.config

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Phone
0733 285911
Server Link 1
http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/GRUPPOEDIF
Server Link 2
https://sapurnale.io/data/GRUPPOEDIF
Files — GRUPPOEDIF
4
Files listing (shown on page)
4

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Negotiation