Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Laboratorios Roemmers SAICF

roemmers.com.ar

Group Aurora
Discovered 2026-10-01 06:55 UTC
Est. attack date 2026-10-01
Country AR
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue, with €1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) — Argentina's equivalent of a Social Security Number — combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records — employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms — individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers. <redacted> 82 GB of drug formulations — the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain. 14 GB of internal drug pricing strategy and competitive intelligence

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 53

Third Party Employee Credentials: 25


External Attack Surface: 6


Infostealer Distribution

Exposure Report
by ParanoidLab
1395
Passwords
81 critical
2
Cookies
0 critical
Last queried 2026-10-01 07:44 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • roemmers-com-ar.mail.protection.outlook.com. Microsoft 365
TXT Records
  • ZOOM_verify_5WVqPHHXSE2Jb8Hc8aE4Kw
  • slk10l7sbjd6pj0lsbrktqj0gf49z4gn
  • bve48AyZL4u8bufoNMKJNkH8aUFKMr/O9HzF4TdlqWNvt17p1uoT0tZuSoKyaW9jZbmiEYYeuOLQwAC7Q+gjZQ==
  • qpj8p89rogr8eulfctldmhb5fk
  • lp662hjol14djfhpdans9g4ngr
  • xcgl35vpkqrzhqz4wnqr1dxv22869hk3
  • MS=ms70324827
  • v=spf1 ip4:200.49.93.194 ip4:200.127.148.194 ip4:200.49.93.195 ip4:200.127.148.195 ip4:52.254.6.248 ip4:104.210.5.76 include:spf.protection.outlook.com include:_spf.clickexperts.net include:amazonses.com include:spf.fromdoppler.com ~all
  • _1ovyg74jizc878p2jwew0owm6jqxxys
  • 3/KMpz0cPP3d0UjKdKQW1Xedag/K0BatNWt0MNsZmfPhoKwi8fojo/icIS/IGlCrnF8P6HUjEnVVdcrAJK7ssQ==
  • google-site-verification=OUvQduFcVtmW5I-9nN4u0c0FOFzsjh4DikpzdSB6Vg0
  • google-site-verification=SK4u7JxKD0EZ0kxv5ASpr2dBupQxfMzLY0JWpNLIjGA
  • atlassian-domain-verification=900FaVs9FdQ6HmM287NGiDN924EKbpQE5EMRjzN8lOsCKMBwFEDIu30TAW8tkcwa
  • _0o5xp9xx0kmdmwuhjum62rf3g1m7bvi
  • u7d8bcm6q6d73s863bu71voi2t
  • jstp7vn5guk2rtf4v723l6so97
  • tosi5q3p5ail9tb9s61ol0j00e
  • anthropic-domain-verification-h3d3m1=4DKa7HjNGyxzo08bT8qHumhpj
  • fnc2wl5vv9jw0mnz1vltrm78zwwttt25
  • MS=ms38080229
Cloud / SaaS Services Detected
Amazon SES/WorkMail Anthropic Atlassian Microsoft 365 Zoom

Leak Screenshot:

Leak Screenshot