Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshotAurora claims 6 files were stolen from GILDE Handwerk Macrander GmbH & Co. KG, a family-owned German wholesale group headquartered in Bocholt, Nordrhein-Westfalen. The data claimed to have been taken include banking keys and certificates, personal identity documents, tax certificates, payroll and financial records, and business data such as inventory valuations, customer and supplier data, pricing, and order history. The leak post is listed on the threat group’s leak site and provides the address Dingdener Straße 199, Bocholt.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Employees
- 0
- Domains
- https://www.gildehandwerk.com/en/
- Platforms
- EBICS HBCI
- People named
- Hamid Yazdtchi
What was taken
GILDE Handwerk Macrander GmbH & Co. KG is a family-owned German Mittelstand group headquartered in Bocholt, Nordrhein-Westfalen. The GILDE Gruppe operates across wholesale trade in gifts, home accessories, and furniture through brands including GILDE Handwerk, Fink Living, and HAKU Möbel, with 50+ legal entities spanning Germany, Austria, the Netherlands, France, the UK, and Hong Kong. The exposed material includes: Complete EBICS/HBCI banking infrastructure — cryptographic keys, DER-encoded certificates, and authentication stores for every group bank account at Sparkasse, Volksbank, Commerzbank, BNP Paribas, Bank Austria, Credit Suisse, Helaba, Postbank, and Multivia. These keys authorise electronic payment transactions. 148+ personal ID document scans — Personalausweise (national ID cards), Reispässe (passports), Führerscheine (driver's licences), and Heiratsurkunden (marriage certificates) for employees, directors, and family members. ELSTER tax certificates for 50+ entities — the digital keys for filing tax returns with the German Finanzamt, plus personal certificates for directors and family members. Enables fraudulent VAT returns and income tax filings. 100+ plaintext credential documents — banking portal passwords, marketplace logins (Amazon, eBay, Otto, Wayfair), payment processor credentials (Telecash, Concardis, PayPal), ERP system access, and government portal credentials, all stored as unencrypted Word and PDF files. Full employee payroll records (2006–2025) — tax IDs (Steuer-IDs), social security numbers, bank accounts, salary details, sick notes (Krankmeldungen), and disciplinary records for an estimated 200–400 current and 200–500 former employees across all entities. 20 years of consolidated financial records — balance sheets, P&L statements, bank reconciliations, loan documentation, shareholder agreements
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- [email protected]
- Phone
- +49 (0) 2871 / 188-0
- [email protected]
- phone
- +49 (0) 2871 / 188-0
- Address
- Dingdener Straße 199 - GILDE-Platz 46395 Bocholt - Germany
- address
- Dingdener Straße 199 - GILDE-Platz 46395 Bocholt - Germany
- https://www.facebook.com/gilde.group/
- https://www.linkedin.com/company/gilde-gruppe
- https://www.instagram.com/gilde_1960/
- Group profile
- The GILDE Gruppe operates across wholesale trade in gifts, home accessories, and furniture through brands including GILDE Handwerk, Fink Living, and HAKU Möbel, with 50+ legal entities spanning Germany, Austria, the Netherlands, France, the UK, and Hong Kong.
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.