Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Listed on a ransomware leak site

EWM Group

ewm-group.com

EWM Group was listed on the Aurora leak site on Oct 28, 2026. Information as of Oct 29, 2026.

Country: GermanyIndustry: Manufacturing
Updated continuously · figures as of Oct 29, 2026
Claimed by
Aurora
First listed
Oct 28, 2026
Claims recorded
1

Leak-Site Claim.

AuroraConfirmed claim
Posted on the leak site
Oct 28, 2026
Collected by Brandefense
Oct 28, 2026
Data claimed
Not stated
Leak-site post text, written by the group
EWM Group, the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains. The exposed material includes: 503,878 loyalty programme member records, full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000-2026. ~21,000 employee records, salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details. 100+ GB of…

Get alerted the moment your company or a supplier is posted on a leak site.

Alert me
Other confirmed victims claimed by the same group
VictimClaimed byCountryIndustryData claimedPosted
Meleghy Automotive & Cie. GmbHAuroraDEGermanyManufacturingNot stated
GreenbergFarrow
greenbergfarrow.com
AuroraUSUnited StatesConsultingNot stated
Ernesto Malvestiti S.p.A.AuroraITItalyManufacturingNot stated
ARX Group SAAuroraCHSwitzerlandEducation and ResearchNot stated
Allmand-Smith LimitedAuroraGBUnited KingdomManufacturingNot stated
Duarte Nursery, Inc.
duartenursery.com
AuroraUSUnited StatesAgricultureNot stated
Other confirmed victims in the same industry
VictimClaimed byCountryIndustryData claimedPosted
Fortrex
fortrex.com
WallstreetUSUnited StatesManufacturingNot stated
Hauhinco
hauhinco.com
PayloadDEGermanyManufacturing101 GB
Meleghy Automotive & Cie. GmbHAuroraDEGermanyManufacturingNot stated
Bi Link
bi-link.com
The GentlemenUSUnited StatesManufacturingNot stated
TWICE SRL
twicestudiobijoux.com
EmperadorITItalyManufacturing560 MB
Natuzzi
natuzzi.com
EverestITItalyManufacturingNot stated

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Figures as of Oct 29, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.