Ransomware victim disclosure
← All victimsKFZ Sauter GmbH Co. KG
Claimed by NIGHT SPIRE · listed 18 hours ago
Status timeline
- Listed
Jun 6, 2026
Current state: Listed for ransom
At a glance
- Group
- NIGHT SPIRE
- Status
- Listed for ransom
- Country
- Germany
- Sector
- Automotive
- Listed on leak site
- Jun 6, 2026
- Data size
- 600 GB
About the victim
AI dossier — public-source company profileKFZ Sauter GmbH & Co. KG is a German automotive service company based in Bubesheim offering used vehicle sales, repair services for all car makes, used parts retail, and vehicle recycling compliant with environmental regulations.
- Industry
- Automotive Repair & Recycling
- Address
- Industriestraße 15–17, 89347 Bubesheim, Germany
Attack summary
Severity: medium — Claimed exfiltration of 600 GB including financial, HR, and banking data represents moderate-to-significant exposure. However, most proof files are marked unavailable, preventing verification of actual data compromise scope or sensitivity.NIGHT SPIRE claims to have exfiltrated approximately 600 GB of data from KFZ Sauter. The leak post lists financial documents, HR data, banking records, employee information, and business contracts, but most proof links are marked 'Data is not available now.'
Data the group says was taken
AI dossier — extracted from the leak post- Financial & Banking Records
- HR & Employee Personal Data
- Accounting & Tax Records
- Contracts & Invoices
- QuickBooks Files
- Business Strategy Documents
- MSSQL Database
- Scanned Tax Returns
- Email & SMS Data
- Customer/Supplier Information
The leak post
captured from the group's site- Financial Documents- HR Data- Supervisor's Information Data is not available now. Data is not available now. Data is not available now. [la familia adualt day center](http://www.lafamiliaadultdaycenter.com) Data is not available now. Data is not available now. - QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups - Banking & Financial Records- Personal data- Critical POS Data - Banking & Financial Data- Accounting & Tax Records - Financial & Accounting Records- Human Resources- Sales & Marketing - Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data Data is not available now. - Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files - MSSQL-DB- HR Documents- Contracts Data is not available now. [Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com) - Patients Information Records- Financial Records [The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org) - Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…
Data the group says was taken
- Banking Finance
- Accounting Buchhaltung
- Contracts Legal
- GDPR Personal Data
- Documents Images
Screenshot of the leak post
Sources
Source
Indexed 18 hours agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.