INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aurora Publishes New Victim Dr Bien Rechtsanwaltskanzlei Attacked

| 2026-10-12 16:59 CRITICAL LOW RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
On October 12, 2026, a ransomware attack was launched against Rechtsanwaltskanzlei Dr. Bien, a specialist insolvency law firm in Hamm, NRW, Germany, with the cyber operation type being exfiltration and ransomware. The targeted sector includes finance and legal industries. The identified entity affected is WinSolvenz, with 2,387 WinSolvenz case databases exposed, each containing financial dossier information of an insolvency debtor. Additionally, 492+ forced administration case files were also compromised, along with an 80 GB MailStore email archive and a 1.7 GB beA backup containing electronic communication records between the firm and German courts. The attack resulted in the exposure of 35 employee records, including 25 former and approximately 10 current staff members.
Technical Mitigations AI-generated
• Patch Microsoft Access MDB files to prevent exploitation of vulnerabilities in the database format. • Monitor for forced administration (Zwangsverwaltung) case files and block or hunt for suspicious property addresses, tenant data, rent records, utility accounts, insurance details, and court-directed property management reports. • Use a secure email client to detect and respond to attorney-client communications, court correspondence, creditor negotiations, and debtor disclosures in the MailStore email archive.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
DACH DACH legallegal financefinance
Incident Timeline
‎2026/10/12
Aurora has published a new victim, Rechtsanwaltskanzlei Dr. Bien, exposing sensitive financial and legal information from Microsoft Access MDB files, MailStore email archives, DATEV tax/accounting records, and other data stored on various systems.
organisation Hamm, NRW
[law] Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen.
organisation WinSolvenz
The exposed material includes: 2,387 WinSolvenz case databases —
organisation Microsoft Access
each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details.
organisation MailStore
<redacted> 80 GB MailStore email archive — the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures.
data_breach 1.7 GB beA backup
1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court.
organisation DATEV
DATEV tax/accounting archives — 33 directories of income tax backups, insolvency accounting, third-party mandates.
data_breach 35 employee records
35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements.
Tactical Metrics
Metrics
data_breach
2
Gb Bea Backup
1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court.
Metrics
data_breach
35
Employee Records
35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements.
Intelligence Sources
Ransomware Live 2026-10-12