Summary
Written by ThreatClusterfrom file listing, victim profile, leak post, screenshotAurora states that 268 GB of data across approximately 124,000 files were exfiltrated from Planungsgruppe M+M AG, spanning two file servers (MMBB04 and MMBB05) and related systems such as DATEV, SFirm, ELO, and Outlook PSTs. The claimed data types include Outlook email archives, payroll/HR data, DATEV financial processing archives, SFirm banking databases, and ELO document management data. The victim is presented as Planungsgruppe M+M AG, a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with about 432 employees and roughly €52 million in revenue. The leak post is listed on the group’s leak site.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Employees
- 432
- Platforms
- DATEV SFirm ELO Outlook
What was taken
Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with approximately 432 employees across 10 offices (Böblingen, Stuttgart, München, Nürnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately €52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation. The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data — a total of 268 GB across approximately 124,000 files, covering 2006 to 2026.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- [email protected]
- Phone
- +49 7031 646-0
- Address
- 71034 Böblingen
- https://www.linkedin.com/company/planungsgruppe-m-m-ag
- server_links
- ["http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/PGMM", "https://sapurnale.io/data/PGMM"]
- Files_on_page
- 8
- Server Link 1
- http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/PGMM
- Server Link 2
- https://sapurnale.io/data/PGMM
- projects_completed
- Over 5,200 projects completed across decades of operation.
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.