# Aurora group lists FREYWILLE jewelry data

Published: 2026-08-11 · Severity: high · Sectors: retail
Canonical: https://vorant.io/reports/1efbfadb-784c-51bf-a860-3dc3343576b5/aurora-group-lists-freywille-jewelry-data

> Ransomware/extortion group Aurora claims a breach of Austrian luxury jeweler FREYWILLE, exposing employee PII and trade-secret enamel formulas.

Ransomware.live has indexed a leak-site posting attributed to the Aurora extortion group claiming compromise of FREYWILLE, an Austrian fire-enamel jewelry maker with over 70 boutiques worldwide. The claimed dataset includes over 142 employee files spanning salary records, social security numbers, employment contracts across 24 countries, COVID vaccination records, passport copies, and a decade of visa card statements — representing significant PII exposure risk for the company's global workforce.

Beyond personal data, the actors claim to hold FREYWILLE's proprietary trade secrets, including 2025 product costing across all product lines and the company's signature enamel colour recipes (SPHINX, JOYB2, Entwurf) from its Siebdruck department — described as the core intellectual property underpinning the brand's fire-enamel technique. The leak also reportedly contains legal defence files from 40+ lawsuits across eight countries, including a criminal proceeding, and internal documentation of a prior 2018 webshop malware incident (DSB filings, breach notifications, incident reports), suggesting this may not be FREYWILLE's first cybersecurity incident.

No technical indicators, initial access vector, or exploited vulnerability are disclosed in the posting. This appears to be a single-victim extortion listing rather than evidence of a broader campaign; severity is assessed based on the sensitivity and breadth of the claimed data rather than any confirmed technical compromise mechanism.

## Mentioned in this report

- Threat actors: aurora

Source reporting: https://www.ransomware.live/id/RlJFWVdJTExFQGF1cm9yYQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1efbfadb-784c-51bf-a860-3dc3343576b5/aurora-group-lists-freywille-jewelry-data.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup