Back to Victim Disclosures

EWM Group

auroraransomware group
Publishes in11d 8h 45m 59s
2h ago

Added Oct 28, 2026

EWM Group — the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains. The exposed material includes: 503,878 loyalty programme member records — full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000–2026. ~21,000 employee records — salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details. <redacted> <redacted> <redacted> <redacted> <redacted> 100+ GB of Outlook PST email archives — complete email histories for named staff members spanning years of business operations. 313+ SQL Server database backups across 122 unique databases — the entire digital brain of the retail operation. 83 GB of e-commerce transaction data — every online order from January 2021 to August 2026.

Leak Page Screenshot

Organization Details

Organization

EWM Group

Leak Data

Data Size

83 GB

Publication Due

Nov 9, 2026

Publication Status

Pending

Discovered

Oct 28, 2026

Data Types
PIIEmployee recordsFinancialTransaction history
GDPR
Leak URL
http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/ewm-group-b175f7dc
Site OnlineLast scanned 1m ago

Threat Group

aurora

ransomware group

View full group profile →

Quick Facts

Data Size83 GB
AddedOct 28, 2026