Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshotThe group aurora claims 22 GB of SQL Server production database backups were taken from Pyramid Analytics B.V., with 4 files published. Data claimed include source code, private keys, API keys, service account credentials, database passwords, database backups, user accounts and credentials, business data, customer data, retail sales data, and OLAP cube backups. The leak page identifies the victim as Pyramid Analytics B.V. and states it was acquired by ServiceNow; the post is currently listed.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Domains
- pyramidanalytics.com
- Platforms
- Google Gemini OpenAI Azure AI IBM Watsonx
What was taken
Pyramid Analytics B.V. — a decision-intelligence platform company headquartered in Amsterdam, acquired by ServiceNow (NYSE: NOW).
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- acquired_by
- ServiceNow (NYSE: NOW)
- Server Link 1
- http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/DEVPA
- Server Link 2
- https://sapurnale.io/data/DEVPA
- AI integration architecture
- The complete AI integration architecture showing connections to Google Gemini, OpenAI, Azure AI, and IBM Watsonx.
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.