company allegedly hacked as reported by aurora ransomware with details: Ernesto Malvestiti S.p.A. a privately-held Italian maker of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 gigabit SQL server backup �7 copies) every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB �5).
GDPR Article 9 special-category data medical fitness records, disability status, jointure membership lists, workplace injuries, occupational diseases, and emphasize assessments for the entire workforce.
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
SQL Server administrator watchword for the payroll database server, stored in a plaintext ODBC registry export.
ADP payroll SFTP credentials stored in WinSCP.ini the channel used to transmit employee salary data to the external payroll processor.
614 MB of financial/controlling data consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
1.5 GB of engineering IP 300+ mulct blanking conk designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
160+ client/supplier contracts with pricing, commercial terms, and executed NDAs.
560+ task candidate CVs with full names, addresses, phone numbers, and career histories.