Planungsgruppe M+M AG Data Breach

Aurora ransomware has claimed Planungsgruppe M+M AG, a German engineering and planning consultancy, as a victim. The threat actor listed the company on its leak site on August 17, 2026, an event identified by SOCRadar’s Dark Web Monitoring service. While the listing is currently unverified, the company’s role in project management, infrastructure planning, and construction consulting places it within sectors often targeted by ransomware operations. This claim adds to Aurora’s pattern of targeting German entities. In the 60 days preceding this claim, Aurora had listed 11 victims. The ransomware group primarily targets the Manufacturing, Retail & E-Commerce, and Professional Services industries. Geographically, its recent victims are located in Germany, the United States, and the Netherlands. Planungsgruppe M+M AG aligns perfectly with Aurora’s established targeting profile for German professional services firms. Other recent German victims claimed by Aurora include GILDE Handwerk Macrander GmbH & Co. KG, Evosys Laser GmbH, Primed Halberstadt Medizintechnik, and Natco Home Group.

SOCRadar’s analysis of stealer-log telemetry found zero records associated with the domain dieplanungsgruppe[.]de within the queried data slice. It is important to note that a lack of stealer-log records does not definitively confirm that an organization is unaffected. For German professional services firms like Planungsgruppe M+M AG, which may have a limited consumer-facing digital footprint, their credentials are often underrepresented in general stealer-log datasets. Credentials belonging to such organizations could exist in adjacent query pages, under alternate corporate domains, or be associated with employee personal email aliases, none of which would be captured by a single-domain, limited-slice query. The absence of evidence in this specific query is not evidence of the absence of compromise. Aurora commonly obtains infostealer credentials from underground markets, subsequently validating corporate access through Microsoft 365, VPNs, or remote-access portals before deploying their ransomware. This methodology makes companies like Planungsgruppe M+M AG, which fit Aurora’s preferred target profile, susceptible. Extended monitoring of dieplanungsgruppe[.]de across alternate telemetry feeds is therefore recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.