Skip to content
Leak-site post naming SCA Logistik & Fulfillment GmbH, captured by ThreatCluster
Back to victims

SCA Logistik & Fulfillment GmbH

aurora

Ransomware leak-site victim intelligence · DE

Data size
1.707 TB
Files
7
Views
50,336
Posted
Sep 5, 2026
Country
Germany
Industry
logistics/fulfillment

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

The leak claims that HR records, financial records, customer contracts, source code, and employee and applicant files were taken from SCA Logistik & Fulfillment GmbH. The leak post was published on 2026-09-05 on the group’s leak site. The page states the victim is SCA Logistik & Fulfillment GmbH, with the domain sca-muc.de, described as a Bavarian logistics and e-commerce fulfillment provider.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
https://www.sca-muc.de/

What was taken

SCA is a Bavarian logistics and e-commerce fulfillment provider. The exposed materials includes: Spans customer orders; Shipments and returns; Employee and applicant files; Management, tax and banking records; Warehouse automation; Source code; Customer contracts.

Data categories
HR recordsfinancialscustomer contractsorder datasource code
Leak site tags
logistics
File types seen
csv × 3json × 1config × 3
Sample files (7)
DE_75_EUR_Gutscheinkarte_SCA_2026 - Tabellenblatt1.csv
100_CHF_Gutscheinbox_giftcards_2026_03_25_14_52_33.csv
250_CHF_Gutscheinbox_d90ee9de-e17b-42dd-b18a-00dd8dcca55a.csv
service-account-key.json
SQSTool.exe.config
Web.config
Web.f5c6697db0d6.config

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Email
[email protected]
Address
Birkenweg 5b 85399 Hallbergmoos
Files shown
7
Server Links
["http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/SCA", "https://sapurnale.io/data/SCA"]
Server links
["http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/SCA", "https://sapurnale.io/data/SCA"]
server_links
["http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/SCA", "https://sapurnale.io/data/SCA"]
Server Link 1
http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/SCA
Server Link 2
https://sapurnale.io/data/SCA

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Negotiation
Email [email protected]
Onion fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion