PROJAHN

German manufacturer and distributor of professional precision

and hand tools (drill bits, masonry/wood/steel tools, thread tools, measuring tools, sockets, wrenches, screwdrivers, pliers, flashlights, workbenches).

PROJAHN Präzisionswerkzeuge GmbH — Breach Impact Report

SUMMARY

We obtained tens of thousands of files from PROJAHN Präzisionswerkzeuge GmbH, a German precision tools manufacturer. The dataset spans finance, legal, HR, manufacturing, and export control operations, with the heaviest concentration of material from 2025 through September 2026.

The archive includes several thousand invoices and price lists, over a thousand sanctions screening records, hundreds of employee files, annual financial statements, calculation sheets, and VPN configurations with associated certificates. The data was extracted from a central network storage system.

What stands out is the combination of competitive intelligence—pricing calculations, customer lists, supplier relationships—with compliance documentation showing exactly how the company screens export transactions against sanctions lists.

WHAT WE HAVE

Personal Data

The dataset contains personnel files for current and former employees. We found employment certificates, salary confirmations, work attestations, and tax withholding documents. Files include names such as Abdal Seidan, Jan Scholtalbers, Oleg Merk, Romain Boyancé, Alexandre Barbry, Martina Ziegler, and others.

These documents contain home addresses, salary information, tax IDs, and employment history.

Additionally, there are applicant files—hundreds of documents related to job applications including CVs and application correspondence.

Financial Records

The financial documentation is extensive. We have:

Several thousand invoices (Handelsrechnung, RECHNUNG files) for domestic and export transactions

Annual financial statements for 2024 including BWA reports, VAT returns, and general ledger extracts

Hundreds of bonus calculation sheets showing payment structures

Over a thousand dunning letters (Mahnungen) revealing customer payment behavior

Hundreds of pricing calculations (Kalkulation) showing cost structures and margins

The pricing documents are particularly detailed— [Link entfernt] and similar files contain the underlying calculations for product pricing across multiple product lines and seasons.

Export Control & Sanctions Compliance

This is the most sensitive category from a regulatory perspective. We have over a thousand sanctions screening records (Sanktionsprüfung) showing individual checks performed on business partners and individuals. Files reference names including Aleksandr Koval, Andrej Zotikov, Denis Pozdneev, Dmitriy Goloschapov, Sergej Kros, and others—primarily Cyrillic names suggesting screening related to Eastern European or Eurasian transactions.

These documents reveal:

Which customers and individuals the company screens

The screening methodology and tools used

Transaction-level compliance documentation

We also have regulatory compliance files related to ElektroG (German Electrical and Electronic Equipment Act) and conflict minerals reporting, including supplier lists and weight documentation.

Manufacturing & Intellectual Property

The dataset includes manufacturing data:

Bill of materials (Stückliste files)

Calculation sheets for product lines including HAND and PRÄZ series

Product design files and label specifications

Marketing materials and product photography

These documents show cost structures, supplier relationships, and pricing margins—information that would be valuable to competitors.

System Access Credentials

We extracted digital certificates and VPN configurations:

Multiple .pem files for [Link entfernt] including private keys

pfx certificate files for ELSTER (German tax authority) access

ovpn VPN configuration files for external connections

These files enable authentication to internal systems and government portals.

Legal & Compliance Documentation

The archive contains internal policies, operational procedures, and regulatory correspondence. We found operational guidelines for vehicle fleet management, internal process documentation, and correspondence related to legal matters.

WHO CAN RECEIVE THIS DATA

Regulators

German data protection authorities (Landesdatenschutzbeauftragte) have jurisdiction over the employee and applicant personal data. The volume and nature of the PII—salary information, tax documents, employment records—creates clear GDPR exposure.

Export control authorities (BAFA - Bundesamt für Wirtschaft und Ausfuhrkontrolle) would have interest in the sanctions screening documentation, as it reveals compliance practices and potentially identifies screened parties.

Competitors

The pricing calculations, cost structures, customer lists, and supplier relationships represent significant competitive intelligence. Any tool manufacturer operating in the same market segments could use this data to:

Undercut pricing based on known margins

Target the company's customers with better offers

Identify and potentially poach supplier relationships

Individuals

Current and former employees can be contacted directly regarding the exposure of their personal data. Applicants whose CVs and application documents are in the dataset can similarly be notified.

Business Partners

Customers identified in invoices and correspondence, as well as suppliers referenced in the calculation sheets, have an interest in knowing their commercial relationship with PROJAHN has been exposed.

WHAT CAN HAPPEN

The full dataset can be published, making all documents permanently searchable and accessible

Pricing and calculation data can be shared with competitors, undermining PROJAHN's market position

Employee personal data can be used for targeted phishing, identity fraud, or social engineering attacks

Sanctions screening records can be analyzed to identify business relationships and compliance patterns

VPN configurations and certificates can provide ongoing access to internal systems

ELSTER certificates can potentially be used to file fraudulent tax documents

Customer payment behavior data from dunning records can inform competitive targeting

Regulatory complaints can be filed with German data protection and export control authorities

Once published, this data becomes part of the permanent record—indexed, archived, and available for future due diligence, litigation, or competitive research by any party