Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reportingEverest’s leak post claims 1.04 TB of data from KÖRBER (koerber.com) has been exfiltrated, totaling 1,701,008 files from a multi-year HighJump, Körber, and Infios product ecosystem, including installation packages, editable SQL logic, client-side JavaScript, and related database artifacts. Sample filenames published include WMS_TestDataBase.bak, WMS_Test.mdf, and WMS_Test_acg.adf. The data categories claimed cover warehouse operations, ERP and external interfaces, financial and labor management, transportation, analytics and reporting, access and platform management, and development and support. The leak page states the publication status is published and shows a countdown timer to file publication, with a timer message indicating the files will be published after it counts down.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Platforms
- Warehouse Edge HighJump One Koerber One Infios Platform Pulse
What was taken
The data repository represents a multi-year HighJump, Körber, and Infios product ecosystem. It contains installation packages, editable SQL logic, client-side JavaScript, XAML workflows, managed .NET assemblies, PDB files, reports, ERP integrations, application packages, development tools, technical documentation, database backups, logs, and complete virtual machines. The active WMS_TestDataBase catalog contains 196 user tables, 86 stored procedures, 22 views, 24 triggers, 10,512 columns, and 132 complete T-SQL definitions. The catalog includes 118 active BAL_* objects, including 60 BAL_WMS_* objects. They implement ERP exchange, data reconciliation, printing, routing, manifests, coil-processing logic, and other customer-specific processes.
Ransom note
Published by the group on their leak site, reproduced verbatim.
The files will be published after the timer counts down. The company still has time to get in touch with us
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- site
- koerber.com 1TB DataBase
- timer_message
- The files will be published after the timer counts down. The company still has time to get in touch with us
- countdown_display
- 0 0 d : 0 3 h : 4 4 m : 3 6 s
- This post unlocks when the timer ends.
- This post unlocks when the timer ends.
Leak-site images (11)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.