INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aurora Publishes New Victim EWM Group

| 2026-10-28 13:00 CRITICAL HIGH RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
On October 28, 2026, the UK-based retail sector was targeted by a ransomware attack attributed to Aurora, with EWM Group, parent company of Peacocks, being one of its victims. The exposed material includes sensitive data from over 503,878 loyalty programme member records and approximately 21,000 employee records, as well as 100+ GB of Outlook PST email archives spanning years of business operations. Additionally, the attackers accessed 313+ SQL Server database backups across 122 unique databases and 83 GB of e-commerce transaction data covering a period from January 2021 to August 2026. The attack is classified under Exfiltration and Ransomware tactics, utilizing Hydraq as its malware payload.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
FIVE_EYES FIVE_EYES financefinance retailretail
Incident Timeline
‎January 2021 to August 2026
Threat actors published 83 GB of e-commerce transaction data, covering every online order from January 2021 to August 2026.
data_breach 83 GB
83 GB of e-commerce transaction data — every online order from January 2021 to August 2026.
‎2026/10/28
Threat actors used SQL Server to expose sensitive data from EWM Group's 122 unique databases, including loyalty programme member records and employee information.
organisation Peacocks
Description: [fashion] EWM Group — the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains.
organisation EWM Group
🏴‍☠️ Aurora has just published a new victim : EWM Group.
organisation National Insurance
~21,000 employee records — salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details.
organisation WAGESTRANSFER
~21,000 employee records — salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details.
organisation Outlook PST
<redacted> <redacted> <redacted> <redacted> <redacted> 100+ GB of Outlook PST email archives — complete email histories for named staff members spanning years of business operations.
data_breach 122 unique databases
313+ SQL Server database backups across 122 unique databases — the entire digital brain of the retail operation.
data_breach 503,878 member records
The exposed material includes: 503,878 loyalty programme member records — full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000–2026.
Tactical Metrics
Metrics
data_breach
122
Unique Databases
313+ SQL Server database backups across 122 unique databases — the entire digital brain of the retail operation.
Metrics
data_breach
83
Gb
83 GB of e-commerce transaction data — every online order from January 2021 to August 2026.
Metrics
data_breach
503,878
Member Records
The exposed material includes: 503,878 loyalty programme member records — full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000–2026.
Intelligence Sources
Ransomware Live 2026-10-28