Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshotAurora claims 156 GB of data across 6 files from Van Eijck International Car Rescue B.V. has been taken and is listed on the group's leak site. The material is described as including employee records, HR data, tax forms, salary data, photos, identity documents, driving licenses, vehicle registrations, customer claims data, and financial databases, with 227 employee home directories totaling 156 GB. The leak also claims exposed credentials and configurations, such as a plaintext Azure AD Connect service account password, KeePass vaults, FortiGate firewall configurations for all offices, 12 GB of RentRunner customer rental contracts with copies of identity documents, driving licenses, and vehicle registrations, 10 years of customer claims data, a Google Workspace backup for 18 users and 206 groups, and a plaintext Unit4 ERP admin password.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Employees
- 0
- Domains
- www.eijck.com
- Platforms
- Azure AD Connect Active Directory Microsoft 365 KeePass FortiGate Google Workspace CubeBackup Unit4 ERP
What was taken
Van Eijck International Car Rescue B.V. — a family-owned Dutch towing and recovery
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- [email protected]
- Phone
- +31 (0) 85-0206000
- Address
- Langendijk 5 5652 AX Eindhoven The Netherlands
- YouTube
- https://www.youtube.com/channel/UCm1s4-NU7qYphXgkzUdMwOQ
- https://www.facebook.com/vaneijckmobility
- https://www.linkedin.com/company/van-eijck-groep-bv/
- Server Link 1
- http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/VRSCLOUD
- Server Link 2
- https://sapurnale.io/data/VRSCLOUD
- Office_locations
- 20 branch offices across the Netherlands and Spain
- The exposed material includes
- ["The Azure AD Connect service account password in plaintext — the credential that synchronises every identity between on-premises Active Directory and Microsoft 365.", "9 KeePass password vaults (6 company copies + 1 MSP vault + 2 personal), distributed across IT admin home directories. If the master password is weak, the attacker owns every credential the company has.", "FortiGate firewall configurations for all 20 branch offices — admin password hashes, VPN pre-shared keys, RADIUS secrets, SNMP community strings, complete firewall rulesets, NAT tables, and internal IP architecture.", "227 employee home directories (156 GB) containing personal documents, tax forms (loonheffingen), salary records, photos, and financial data.", "12 GB of RentRunner customer rental contracts with copies of identity documents, driving licenses, and vehicle registrations.", "10 years of customer claims data (2010–2019) — 500+ individual claims with damage assessments, insurance details, and customer PII.", "Complete Google Workspace backup (CubeBackup) — Gmail, Drive, and Calendar for 18 user accounts and 206 groups.", "The Unit4 ERP admin password (sysadm) in a plaintext INI file — 30+ financial databases accessible."]
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.